CCDL2 Practice Questions - Certified CyberDefender Level 2 (CCDL2, Formerly CCD) Exam

Access More Questions

A threat hunter analyzing Elastic SIEM logs wants to identify processes that spawned cmd.exe from a browser process (e.g., chrome.exe). Which KQL query pattern correctly targets this parent-child relationship?

process.name: cmd.exe AND process.parent.name: chrome.exe process.name: cmd.exe AND event.type: start event.category: process AND process.executable: *cmd* winlog.event_id: 4688 AND process.name: chrome.exe

Correct Answer:

process.name: cmd.exe AND process.parent.name: chrome.exe

Access more questions from this quiz

Continue to CCDL2 Practice Questions - Certified CyberDefender Level 2 (CCDL2, formerly CCD) Exam for more practice questions and the full quiz experience.

Access More Questions