CrowdStrike
CCFH-202B · Question #56
CCFH-202B Question #56: Real Exam Question with Answer & Explanation
Sign in or unlock CCFH-202B to reveal the answer and full explanation for question #56. The question stem and answer options stay visible for context.
Question
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid ImageFileName=________ event_simpleName=ProcessRollup2
Options
- A*$Recycle Bin^
- B$Recycle Bin
- C^$Recycle Bin*
- D^$Recycle.Bin%^
Unlock CCFH-202B to see the answer
You've previewed enough free CCFH-202B questions. Unlock CCFH-202B for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.