Which of the following Event Search queries would only find the DNS lookups to the domain: www.randomdomain.com?

Answer(s): A

How do you rename fields while using transforming commands such as table, chart, and stats?

By renaming the fields with the “rename” command after the transforming command. e.g. “stats count by ComputerName | rename count AS total_count”
You cannot rename fields as it would affect sub-queries and statistical analysis
By using the “renamed” keyword after the field name. e.g. “stats count renamed totalcount by ComputerName”
By specifying the desired name after the field name. e.g. “stats count totalcount by ComputerName”

Answer(s): D

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time. Which eval function is correct?

Answer(s): C

Which of the following queries will return the parent processes responsible for launching badprogram.exe?

[search (ParentProcess) where name=badprogram.exe ] | table ParentProcessName _time
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessId_decimal AS TargetProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time

Answer(s): B

Free CCFH-202 Exam Braindumps (page: 5)