Exam CCFH-202 topic 1 question 82 discussion

Actual exam question from CrowdStrike's CCFH-202

Question #: 82
Topic #: 1

What is the purpose of the rename command in this query?

event_simpleName=ProcessRollup2 [search event_simpleName=ProcessRollup2 FileName=excel.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid ParentProcessId_decimal] | stats count by FileName CommandLine

A. It runs a sub-search to locate all detections where excel.exe was blocked
B. It renames a field to drive the main search in order to locate all children processes of excel.exe
C. It joins all combinations of parent / children processes involving excel.exe
D. It renames a field to drive the main search in order to locate all parent processes of excel.exe

Show Suggested Answer

Suggested Answer: B 🗳️

by Sunaperi at Nov. 4, 2023, 4:58 p.m.

Comments

Submit Cancel

alanalanalan

9 months, 2 weeks ago

Selected Answer: B

B B. It renames a field to drive the main search in order to locate all children processes of excel.exe

upvoted 1 times

...

gr23

1 year, 3 months ago

B. To find the parent process you rename ParentProcessID_decimal to TargetProcessID_decimal. To find the the child you rename TargetProcessID_decimal As ParentProcessID_decimal.

upvoted 3 times

...

Pipo12345

1 year, 4 months ago

Selected Answer: B

B is correct >>> A similar example from internal Crowdstrike docs: event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=winlogon.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid ParentProcessId_decimal] | stats count by FileName CommandLine Explanation: Show all children of a process (e.g.winlogon.exe) – Looking for typical children of a process, to see outliers

upvoted 2 times

...

Sunaperi

1 year, 6 months ago

d is correct