CrowdStrike Exam CCFH-202 Topic 1 Question 29 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 29
Topic #: 1

[All CCFH-202 Questions]

Which of the following is TRUE about a Hash Search?

AWildcard searches are not permitted with the Hash Search

BThe Hash Search provides Process Execution History

CThe Hash Search is available on Linux

DModule Load History is not presented in a Hash Search

Show Suggested Answer

Suggested Answer: B

The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.

by Ryann at Sep 15, 2024, 07:02 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Desmond

1 months ago

This exam is really scraping the bottom of the barrel, isn't it? Next thing you know, they'll be asking about the color of the computer's desktop background.

upvoted 0 times

...

Galen

1 months ago

Wildcard searches? What is this, the Dark Ages? Come on, everyone knows that's not how Hash Searches work. Get with the times, people!

upvoted 0 times

...

Nickole

1 months ago

Module Load History? I thought that was just for hackers and nerds. Who cares about that stuff anyway?

upvoted 0 times

...

Shannan

1 months ago

Process Execution History? Isn't that just a fancy term for 'watching what my computer's doing'? Sounds like a waste of time to me.

upvoted 0 times

Lorrine

24 days ago

D) Module Load History is not presented in a Hash Search

upvoted 0 times

...

Genevive

29 days ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Cherrie

1 months ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Lucille

1 months ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Lenna

1 months ago

The Hash Search is definitely available on Linux. What kind of certification exam is this even testing?

upvoted 0 times

...

Edelmira

2 months ago

I'm pretty sure the Hash Search doesn't allow wildcard searches. That's just common sense, right?

upvoted 0 times

...

Audra

2 months ago

Process Execution History? Sounds like a bunch of techno-babble to me.

upvoted 0 times

...

Lai

2 months ago

Wildcard searches not permitted? What is this, the Stone Age?

upvoted 0 times

Darnell

16 days ago

User 4: That's a bummer, but at least we have other search options.

upvoted 0 times

...

Arthur

20 days ago

User 3: The Hash Search does not allow wildcard searches, unfortunately.

upvoted 0 times

...

Gail

22 days ago

User 2: I agree, it would make searching much easier.

upvoted 0 times

...

Ammie

22 days ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Lorrine

25 days ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Viola

1 months ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Tarra

1 months ago

User 1: I know, right? Wildcard searches should be allowed.

upvoted 0 times

...

Crista

2 months ago

The Hash Search is available on Linux? Well, color me surprised. I thought it was only for Windows users.

upvoted 0 times

Jina

1 months ago

User 4: Nope, it's available on Linux as well.

upvoted 0 times

...

Rosalyn

1 months ago

User 3: I thought it was only for Windows users.

upvoted 0 times

...

Sarah

2 months ago

Yes, it is available on Linux.

upvoted 0 times

...

Mozell

2 months ago

The Hash Search is available on Linux?

upvoted 0 times

...

Helga

3 months ago

D) Module Load History is not presented in a Hash Search? Psh, I could've told you that in my sleep.

upvoted 0 times

Lashawnda

1 months ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Shakira

2 months ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Arminda

2 months ago

A) Wildcard searches are not permitted with the Hash Search

upvoted 0 times

...

Leonora

3 months ago

I see your point, but I still think A) makes more sense because hash searches are usually exact matches.

upvoted 0 times

...

Thaddeus

3 months ago

A hash search? Sounds like a trip to the grocery store if you ask me!

upvoted 0 times

Glenn

2 months ago

D) Module Load History is not presented in a Hash Search

upvoted 0 times

...

Nadine

2 months ago

C) The Hash Search is available on Linux

upvoted 0 times

...

Buck

2 months ago

B) The Hash Search provides Process Execution History

upvoted 0 times

...

Gregoria

2 months ago

A hash search? Sounds like a trip to the grocery store if you ask me!

upvoted 0 times

...

Sylvie

3 months ago

I disagree, I believe the answer is B) The Hash Search provides Process Execution History.

upvoted 0 times

...

Leonora

3 months ago

I think the answer is A) Wildcard searches are not permitted with the Hash Search.

upvoted 0 times

...