MENU
John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.
Which of following Splunk query will help him to fetch related logs associated with process creation?
Suggested Answer: B
Get Premium 312-39 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
t/5a3187b4419202f0fb8b2dd1/1513195444728/Windows+Splunk+Logging+Cheat+Sheet+v2.2.pdf
11 comments · newest first
CH
Chery
12 months ago
Seems like a no-brainer, B is the way to go!
JE
Jesus
12 months ago
3688? Never heard of that one for process creation.
WE
Wenona
12 months ago
I thought it was 4678? Not sure now...
AN
An
1 year ago
Definitely B! That's the correct query.
WI
Willodean
1 year ago
EventCode 4688 is the one for process creation.
OZ
Ozell
1 year ago
I'm leaning towards option B as well, but I wish I had reviewed the event codes more thoroughly before the exam.
BA
Barney
1 year ago
I feel like EventCode 4678 was mentioned in our study materials, but I can't recall if it's specifically for process creation.
TR
Troy
1 year ago
I remember practicing a similar question, and I believe it was about monitoring process creation too. I think option B is correct.
CA
Cathern
1 year ago
I think EventCode 4688 is the one related to process creation, but I'm not completely sure.
IE
Iesha
1 year ago
Okay, I think I know the difference between quality control, quality planning, and quality assurance, but quality improvement is throwing me off a bit. Let me re-read the question and options.
VE
Vernice
1 year ago
Okay, I think I've got this. The "listen port" is 8101, and "enable calculated listen ports" is true, so the two servers will bind to the next available ports, which are 8102 and 8103. I'm pretty confident in this answer.