Which PowerShell cmdlet is useful for gathering system information during threat hunting?

The correct answer is D. Get-Process. Get-Process is the correct answer because it retrieves detailed information about running processes on a system, making it essential during threat hunting to identify suspicious or malicious processes, unusual parent-child process relationships, and processes consuming…

Threat Hunting Fundamentals

Question

Options

AGet-Info
BGet-SystemInfo
CGet-Host
DGet-Process

How the community answered

(29 responses)

A
3% (1)
B
3% (1)
C
7% (2)
D
86% (25)

Explanation

Get-Process is the correct answer because it retrieves detailed information about running processes on a system, making it essential during threat hunting to identify suspicious or malicious processes, unusual parent-child process relationships, and processes consuming unexpected resources. Get-Info (A) and Get-SystemInfo (B) are not real PowerShell cmdlets - they don't exist natively in PowerShell, making them easy traps for guessing. Get-Host (C) is a real cmdlet but returns information about the PowerShell host environment itself (version, culture, UI settings), not system processes or activity useful for threat hunting.

Memory tip: Think "hunters track processes, not hosts" - Get-Process tells you what's running, which is the first question any threat hunter asks when investigating a potentially compromised machine.

Topics

#PowerShell cmdlets#Process monitoring#System information gathering#Threat hunting tools

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice