CrowdStrike Exam CCFH-202 Topic 6 Question 40 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 40
Topic #: 6

Which of the following queries will return the parent processes responsible for launching badprogram exe?

A[search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time

Bevent_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

C[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

Devent_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

Show Suggested Answer

Suggested Answer: D

This query will return the parent processes responsible for launching badprogram.exe by using a subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search, then using stats to count the occurrences of each FileName by _time. The other queries will either not return the parent processes or use incorrect field names or syntax.

by Maryrose at Mar 21, 2025, 09:34 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sharen

2 months ago

I see your point, but I still think D) event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time is the best option

upvoted 0 times

...

Martha

2 months ago

But query C) [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time seems more logical to me

upvoted 0 times

...

Sharen

2 months ago

I disagree, I believe the answer is B) event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

upvoted 0 times

...

Ryan

3 months ago

Haha, imagine if the bad program was called 'badprogram.exe'. That's like something out of a bad movie. Anyway, I think Option C is the way to go - it's the most direct approach.

upvoted 0 times

...