nerdexam
CrowdStrike

CCFH-202B · Question #63

To best determine the root cause of an enterprise wide infection you would:

The correct answer is C. Examine a list of process executions with a specific hash to determine the earliest execution time. You've hit your limit · resets 12:50am (America/New_York)

Incident Investigation and Root Cause Analysis

Question

To best determine the root cause of an enterprise wide infection you would:

Options

  • AExamine a list of processes by hash to determine the latest execution time and last infected
  • BPerform frequency analysis to identify outlier processes that should not be running in your
  • CExamine a list of process executions with a specific hash to determine the earliest execution time.
  • DExamine a list of outbound network connections on non-standard ports to identify suspicious

How the community answered

(18 responses)
  • A
    17% (3)
  • B
    6% (1)
  • C
    67% (12)
  • D
    11% (2)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#root cause analysis#hash analysis#process execution timeline#incident response

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCFH-202B Practice