CrowdStrike
CCFH-202B · Question #63
To best determine the root cause of an enterprise wide infection you would:
Sign in or unlock CCFH-202B to reveal the answer and full explanation for question #63. The question stem and answer options stay visible for context.
Incident Investigation and Root Cause Analysis
Question
To best determine the root cause of an enterprise wide infection you would:
Options
- AExamine a list of processes by hash to determine the latest execution time and last infected
- BPerform frequency analysis to identify outlier processes that should not be running in your
- CExamine a list of process executions with a specific hash to determine the earliest execution time.
- DExamine a list of outbound network connections on non-standard ports to identify suspicious
Unlock CCFH-202B to see the answer
You've previewed enough free CCFH-202B questions. Unlock CCFH-202B for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#root cause analysis#hash analysis#process execution timeline#incident response