Exam CCFR-201 topic 1 question 13 discussion

Answer : C. ContextProcessId_decimal and aid. checked #event_simpleName=FileOpenInfo does not have 'TargetProcessId' in it's field.

Answer : C. ContextProcessId_decimal and aid. checked #event_simpleName=FileOpenInfo does not have 'TargetProcessId' in it's field.

The previous response you provided is accurate and comprehensive. Here's a reiteration: B. ResponsibleProcessId_decimal and aid are the two field values you need from a FileOpenInfo event to perform a Process Timeline search and identify other files opened by the responsible process. Here's a breakdown of why these fields are crucial: ResponsibleProcessId_decimal: This field directly identifies the process that initiated the FileOpenInfo event, which is the process you want to investigate further. aid (Agent Identifier): This unique identifier for the endpoint provides context for the process and allows you to focus the Process Timeline search on the specific device where the file open occurred.

Just checked the fields for event_simpleName=FileOpenInfo and there is no TargetProcessId_decimal. Correct answer is ContextProcessId_decimal. This field is in the output of this event. Also the question says what field do you need from the FileOpenInfo event, so answer has to be ContextProcessId_decimal.

The tool requires two parameters:aid(agent ID) andTargetProcessId_decimal(the decimal value of the process ID)2.These fields can be obtained from any event that involves the process, such as a FileOpenInfo

#event_simpleName=FileOpenInfo does not have 'TargetProcessId' in it's field. ContextProcessId reflects more on the 'responsible process' that spawned the FileOpenInfo event.

I think this is D I looked on the timeline and you need an AID Target AID, and Parent ID.

D, totally

It's D