Digital Forensic Certification Practice Exam

Which tasklist parameter allows you to specify types of processes to include or exclude from the main query?

1. /fi FilterName

2. /u Domain\User

3. /s Computer

4. /m ModuleName

The correct answer is: /fi FilterName

The capability to specify types of processes to include or exclude from the main query in the tasklist command is governed by the filtering option. The parameter that allows for the application of filters is the /fi option, followed by filter criteria. This feature enables users to refine the output seen in the tasklist by applying specific conditions, such as filtering based on the process's status, image name, or session number. For instance, one could filter to view only those processes with a specific name or those that are not in a certain state. This is useful for focusing on particular processes of interest, allowing for more efficient monitoring and management of system resources. The other options serve different functions: one deals with user permissions, another deals with executing commands on remote computers, and the last relates to modules linked to the processes. Therefore, the focus on the /fi parameter specifically targeting the inclusion or exclusion of process types makes it the correct choice for this task.