Exam CCFH-202 Topic 9 Question 22 Discussion
Actual exam question for CrowdStrike's CCFH-202 exam
Question #: 22
Topic #: 9
Question #: 22
Topic #: 9
Which field should you reference in order to find the system time of a *FileWritten event?
Suggested Answer: A Vote an answer
ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the start time of the process that performed the file write operation, which may not be the same as the time when the file was written. Timestamp is the field that shows the time when the sensor data was received by the cloud, which may not be the same as the time when the file was written.
by Newman at Nov 18, 2025, 01:02 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).