CrowdStrike CCFH-202b Exam - Topic 6 Question 7 Discussion

Actual exam question for CrowdStrike's CCFH-202b exam

Question #: 7
Topic #: 6

Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?

AOR

BIN

CNOT

DAND

Show Suggested Answer

Suggested Answer: A

The OR operator is needed to complete the following query, as it allows to search for events that match any of the specified values. The query would look like this:

event_simpleName=ProcessRollup2 FileName=net.exe OR FileName=ipconfig.exe OR FileName=whoami.exe

The OR operator is used to combine multiple search terms or expressions and return events that match at least one of them. The IN, NOT, and AND operators are not suitable for this query, as they have different functions and meanings.

by Han at Apr 05, 2026, 03:03 PM

Limited Time Offer

25%

3 months ago

I think the answer might be OR since we want to include multiple commands in the same query.

upvoted 0 times

...