B.The unique ID of a target process (in decimal, non-hex format). This field exists in almost all events,and it represents the ID of the process that isresponsible for the activity of the event in focus.
Is there a "Process_Id_decimal" option as Falcon Event?
TargetProcessId_decimal: This field represents the process ID of the process being targeted or acted upon by the event. It's often referred to as the "Falcon PID" and is unique per agent ID.
It's B but it should be written like this > TargetProcessId_decimal. It's very misleading, even in the exam is written wrong...
Also definition of TargetProcessId_decimal from Event Data Dictionary > The unique ID of a target process (in decimal, non-hex format). This field exists in almost all events, and it represents the ID of the process that is responsible for the activity of the event in focus. For example, the TargetProcessId of a process that performed thread injection in an InjectedThread event.
upvoted 2 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
examtopics3000
Highly Voted 1 year, 7 months agoNastyNutsu
Most Recent 2 months agoalanalanalan
7 months, 2 weeks agoPipo12345
1 year, 2 months ago