CCFH-202b 試験問題を無料オンラインアクセス

You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

• A.*$Recycle Bin^
• B.^$Recycle Bin*
• C.^$Recycle.Bin%^
• D.*$Recycle Bin*

What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

• A.Domain Search
• B.IP Search
• C.Hash Search
• D.User Search

In the Powershell Hunt report, what does the "score" signify?

• A.A cumulative score of the various potential command line switches
• B.Number of hosts that ran the PowerShell script
• C.Maliciousness score determined by NGAV
• D.How recently the PowerShell script executed

The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?

• A.ParentProcessld_decimal
• B.RawProcessld_decimal
• C.ContextProcessld_decimal
• D.RpcProcessld_decimal

What Investigate tool would you use to allow an analyst to view all events for a specific host?

• A.Process Timeline
• B.Host Timeline
• C.Bulk Timeline
• D.Host Search