CrowdStrike
CCFH-202B · Question #56
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid…
Sign in or unlock CCFH-202B to reveal the answer and full explanation for question #56. The question stem and answer options stay visible for context.
Falcon Event Search
Question
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid ImageFileName=________ event_simpleName=ProcessRollup2
Options
- A*$Recycle Bin^
- B$Recycle Bin
- C^$Recycle Bin*
- D^$Recycle.Bin%^
Unlock CCFH-202B to see the answer
You've previewed enough free CCFH-202B questions. Unlock CCFH-202B for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#wildcard search#EAM query#Recycle Bin detection#Falcon Event Search