Broadcom-VMware
5V0-91.20 · Question #84
An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe. Given this Enterprise EDR query: process_name:cmd.exe AND device_group:HR AND NOT…
The correct answer is A. NOT process_name:cmd.exe. See the full explanation below for the reasoning.
Question
An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe. Given this Enterprise EDR query: process_name:cmd.exe AND device_group:HR AND NOT enriched:true Which example could be added to the query to provide the desired results?
Options
- ANOT process_name:cmd.exe
- BNOT process_original_filename:cmd.exe
- CNOT process_company_name:cmd.exe
- DNOT process_internal_name:cmd.exe
How the community answered
(31 responses)- A77% (24)
- B6% (2)
- C3% (1)
- D13% (4)
Community Discussion
No community discussion yet for this question.