CrowdStrike
CCFR-201B · Question #18
CCFR-201B Question #18: Real Exam Question with Answer & Explanation
Sign in or unlock CCFR-201B to reveal the answer and full explanation for question #18. The question stem and answer options stay visible for context.
Question
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
Options
- ASHA256 and TargetProcessId_decimal
- BSHA256 and ParentProcessId_decimal
- Caid and ParentProcessId_decimal
- Daid and TargetProcessId_decimal
Unlock CCFR-201B to see the answer
You've previewed enough free CCFR-201B questions. Unlock CCFR-201B for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.