CrowdStrike Exam CCFH-202 Topic 8 Question 25 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 25
Topic #: 8

[All CCFH-202 Questions]

Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

ASensor Health report

BLinux Sensor report

CSensor Policy Daily report

DMac Sensor report

Show Suggested Answer

Suggested Answer: B

The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.

by Trinidad at Aug 05, 2024, 04:45 AM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Carolann

3 months ago

Haha, I bet the answer is actually E) Sensor Carrier Pigeon report. Can't forget about those old-school monitoring methods!

upvoted 0 times

Nina

2 months ago

C) Sensor Policy Daily report

upvoted 0 times

...

Shanda

2 months ago

A) Linux Sensor report

upvoted 0 times

...

Katie

3 months ago

I believe it's definitely not in the Mac Sensor report, it has to be the Linux Sensor report.

upvoted 0 times

...

Ellen

3 months ago

This is a tough one, but I think D) Mac Sensor report is the way to go. Gotta cover all the bases, you know?

upvoted 0 times

Charisse

2 months ago

Yeah, the Mac Sensor report would definitely have the details we need.

upvoted 0 times

...

Adelina

3 months ago

I agree, it's important to cover all the bases when looking for that kind of data.

upvoted 0 times

...

Helene

3 months ago

I think D) Mac Sensor report is the best option for that information.

upvoted 0 times

...

Kenny

3 months ago

I'm not sure, but I think it could also be in the Mac Sensor report.

upvoted 0 times

...

Marilynn

4 months ago

Nah, I'm going with A) Sensor Health report. That's where I'd look for details on system activity and processes.

upvoted 0 times

Vivan

3 months ago

D) Mac Sensor report might not have the specific details we are looking for.

upvoted 0 times

...

Loreta

3 months ago

I would go with C) Sensor Policy Daily report, it could have some useful information.

upvoted 0 times

...

Lauryn

3 months ago

I think B) Linux Sensor report might also have some relevant details.

upvoted 0 times

...

Adelle

3 months ago

I agree, A) Sensor Health report is the best option for that information.

upvoted 0 times

...

Lucina

4 months ago

I agree with Carlee, the Linux Sensor report makes the most sense for that kind of information.

upvoted 0 times

...

Carry

4 months ago

Hmm, I was thinking C) Sensor Policy Daily report might have that information. It sounds like the kind of thing that would be in a daily security report.

upvoted 0 times