An Incident Responder Is Going to Run an Indicators of Compromise

Multiple Choice

An Incident Responder is going to run an indicators of compromise (IOC) search on the endpoints and wants to use operators in the expression. Which tokens accept one or more of the available operators when building an expression?

A) All tokens
B) Domainname, Filename, and Filehash
C) Filename, Filehash, and Registry
D) Domainname and Filename only