Which of the following is TRUE about a Hash Search?

The correct answer is B. The Hash Search provides Process Execution History. The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each…

Falcon Platform Investigation

Question

Options

AWildcard searches are not permitted with the Hash Search
BThe Hash Search provides Process Execution History
CThe Hash Search is available on Linux
DModule Load History is not presented in a Hash Search

How the community answered

(58 responses)

A
2% (1)
B
91% (53)
C
5% (3)
D
2% (1)

Explanation

The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.

Topics

#Hash Search#process execution history#module load history#Falcon investigation

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice