CrowdStrike Certified Falcon Hunter (CCFH) — Question 80

Which of the following is TRUE about a Hash Search?

Answer options

• A. Wildcard searches are not permitted with the Hash Search
• B. The Hash Search provides Process Execution History
• C. The Hash Search is available on Linux
• D. Module Load History is not presented in a Hash Search

Correct answer: B

Explanation

The correct answer is B because the Hash Search indeed provides Process Execution History, which is an essential feature. Options A, C, and D are incorrect as they either misstate the capabilities of Hash Search or suggest features that are not included.