CrowdStrike Exam CCFH-202 Topic 1 Question 29 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 29
Topic #: 1

[All CCFH-202 Questions]

Which of the following is TRUE about a Hash Search?

AWildcard searches are not permitted with the Hash Search

BThe Hash Search provides Process Execution History

CThe Hash Search is available on Linux

DModule Load History is not presented in a Hash Search

Show Suggested Answer

Suggested Answer: B

The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.

by Ryann at Sep 15, 2024, 07:02 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Desmond

14 days ago

This exam is really scraping the bottom of the barrel, isn't it? Next thing you know, they'll be asking about the color of the computer's desktop background.

upvoted 0 times

...

Galen

15 days ago

Wildcard searches? What is this, the Dark Ages? Come on, everyone knows that's not how Hash Searches work. Get with the times, people!

upvoted 0 times

...

Nickole

16 days ago

Module Load History? I thought that was just for hackers and nerds. Who cares about that stuff anyway?

upvoted 0 times

...

Shannan

17 days ago

Process Execution History? Isn't that just a fancy term for 'watching what my computer's doing'? Sounds like a waste of time to me.

upvoted 0 times

Genevive

2 days ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Cherrie

3 days ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Lucille

5 days ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Lenna

18 days ago

The Hash Search is definitely available on Linux. What kind of certification exam is this even testing?

upvoted 0 times

...

Edelmira

19 days ago

I'm pretty sure the Hash Search doesn't allow wildcard searches. That's just common sense, right?

upvoted 0 times

...

Audra

20 days ago

Process Execution History? Sounds like a bunch of techno-babble to me.

upvoted 0 times

...

Lai

24 days ago

Wildcard searches not permitted? What is this, the Stone Age?

upvoted 0 times

Viola

4 days ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Tarra

8 days ago

User 1: I know, right? Wildcard searches should be allowed.

upvoted 0 times

...

Crista

1 months ago

The Hash Search is available on Linux? Well, color me surprised. I thought it was only for Windows users.

upvoted 0 times

Jina

3 days ago

User 4: Nope, it's available on Linux as well.

upvoted 0 times

...

Rosalyn

9 days ago

User 3: I thought it was only for Windows users.

upvoted 0 times

...

Sarah

28 days ago

Yes, it is available on Linux.

upvoted 0 times

...

Mozell

1 months ago

The Hash Search is available on Linux?

upvoted 0 times

...

Helga

2 months ago

D) Module Load History is not presented in a Hash Search? Psh, I could've told you that in my sleep.

upvoted 0 times

Lashawnda

17 days ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Shakira

26 days ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Arminda

28 days ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Leonora

2 months ago

I see your point, but I still think A) makes more sense because hash searches are usually exact matches.

upvoted 0 times

...

Thaddeus

2 months ago

A hash search? Sounds like a trip to the grocery store if you ask me!

upvoted 0 times

Glenn

20 days ago

D) Module Load History is not presented in a Hash Search

upvoted 0 times

...

Nadine

22 days ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Buck

23 days ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Gregoria

25 days ago

A hash search? Sounds like a trip to the grocery store if you ask me!

upvoted 0 times

...

Sylvie

2 months ago

I disagree, I believe the answer is B) The Hash Search provides Process Execution History.

upvoted 0 times

...

Leonora

2 months ago

I think the answer is A) Wildcard searches are not permitted with the Hash Search.

upvoted 0 times

...