Broadcom-VMware
5V0-91.20 · Question #72
An administrator uses the following Enterprise EDR search query to show web browsers spawning nonbrowser child processes that connect over the network: (parent_name:chrome.exe OR…
The correct answer is C. childproc_reputation. See the full explanation below for the reasoning.
Question
An administrator uses the following Enterprise EDR search query to show web browsers spawning nonbrowser child processes that connect over the network:
(parent_name:chrome.exe OR parent_name:iexplore.exe OR parent_name:firefox.exe) AND (NOT process_name:chrome.exe OR NOT process_name:iexplore.exe OR NOT process_name:firefox.exe)
Which field can be added to this query to filter the results by signature status?
Options
- Achildproc_publisher_state
- Bprocess_publisher
- Cchildproc_reputation
- Dprocess_publisher_state
How the community answered
(26 responses)- A19% (5)
- B4% (1)
- C69% (18)
- D8% (2)
Community Discussion
No community discussion yet for this question.