Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CrowdStrike CCFH-202b Exam - Topic 1 Question 6 Discussion

Which of the following queries will return the parent processes responsible for launching badprogram exe?
D) event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
A) [search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time
B) event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
C) [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

CrowdStrike CCFH-202b Exam - Topic 1 Question 6 Discussion

Actual exam question for CrowdStrike's CCFH-202b exam
Question #: 6
Topic #: 1
[All CCFH-202b Questions]

Which of the following queries will return the parent processes responsible for launching badprogram exe?

Show Suggested Answer Hide Answer
Suggested Answer: D

This query will return the parent processes responsible for launching badprogram.exe by using a subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search, then using stats to count the occurrences of each FileName by _time. The other queries will either not return the parent processes or use incorrect field names or syntax.


by Tora at Mar 04, 2026, 08:52 AM

Limited Time Offer

25%

Off

Get Premium CCFH-202b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Beckie
8 days ago
I feel option C is too vague. We need specific details for accuracy.
upvoted 0 times
...
Mila
13 days ago
Option A is confusing. I don't see how it connects to the parent process.
upvoted 0 times
...
Veronika
18 days ago
I prefer option D. It seems more straightforward to me.
upvoted 0 times
...
Lezlie
24 days ago
I think option B looks solid. It targets the right event type.
upvoted 0 times
...
Sharee
29 days ago
I like D. It renames properly and focuses on the right process.
upvoted 0 times
...
Maryann
1 month ago
Option C seems too vague. Not sure it will work.
upvoted 0 times
...
Marge
1 month ago
I prefer option B. It gives more context with the stats.
upvoted 0 times
...
Santos
1 month ago
I think option A is the best. Simple and direct.
upvoted 0 times
...
Dustin
2 months ago
I’m leaning towards D. It has the right fields.
upvoted 0 times
...
Leatha
2 months ago
Option C looks good too. Straightforward approach.
upvoted 0 times
...
King
2 months ago
I prefer option B. It seems more detailed.
upvoted 0 times
...
Alecia
2 months ago
I think option A is the best. Simple and clear.
upvoted 0 times
...
Augustine
2 months ago
I disagree, B has the right approach with event_simpleName.
upvoted 0 times
...
Rutha
3 months ago
Wait, is badprogram.exe really a thing? Sounds sketchy!
upvoted 0 times
...
Sheron
4 months ago
Not sure about D, seems overly complicated for this.
upvoted 0 times
...
Ivory
4 months ago
I think A is the right choice, it’s straightforward.
upvoted 0 times
...
Tiera
4 months ago
Option C looks solid for finding parent processes.
upvoted 0 times
...
Mose
5 months ago
Not sure about B, seems overly complicated for this.
upvoted 0 times
...
Tandra
5 months ago
I agree with C, it makes the most sense.
upvoted 0 times
...
Annamae
5 months ago
Wait, is "badprogranrexe" a typo in A?
upvoted 0 times
...
Frederic
5 months ago
I think D is the correct one, actually.
upvoted 0 times
...
Merlyn
5 months ago
Option C looks right to me.
upvoted 0 times
...
Tayna
5 months ago
I have a feeling that option D is the one we discussed in class, but I’m not entirely confident about the field names used.
upvoted 0 times
...
Margart
6 months ago
I’m a bit confused about the difference between options B and D; they both seem to involve renaming fields, but I can't recall which one is more accurate.
upvoted 0 times
...
Rana
6 months ago
I remember practicing with similar queries, and I feel like option C might be the right approach since it directly mentions ParentProcessName.
upvoted 0 times
...
Loren
6 months ago
I think option A looks familiar, but I’m not sure if it correctly references the parent processes.
upvoted 0 times
...

Save Cancel