A Falcon Hunter is reviewing the Host Timeline and sees a process creation event followed by a network connection event. What can be inferred from this sequence?

The network connection caused the process creation

The process may have initiated the network connection

The host was rebooted between the events

The events are unrelated and cannot be correlated

In the Host Timeline, events are displayed with timestamps. How are events typically ordered in the default view?

By severity from highest to lowest

Chronologically from oldest to newest

An analyst is investigating a malware infection. The Host Timeline shows a 'FileWrite' event at 10:00:00, a 'ProcessCreate' event at 10:00:05, and a 'NetworkConnect' event at 10:00:10. The analyst needs to determine the sequence of activities. Which interpretation is most accurate?

The process was created, then the file was written, and then a network connection was made

The process was created, then a network connection was made, and then the file was written

The network connection was made, then the file was written, and then a process was created

The file was written, then a process was created, and then a network connection was made

An analyst is investigating a suspicious process on a host. The Host Timeline shows a 'ProcessCreate' event for the process. The analyst needs to understand what the process did after it was created. Which action should the analyst take to get this information?

Click on the 'ProcessCreate' event and review the 'Parent Process' field

Click on the 'ProcessCreate' event and review the 'Command Line' field

Look for subsequent events in the timeline related to the process, such as 'FileWrite' or 'NetworkConnect'

Click on the 'ProcessCreate' event and review the 'User' field

To reconstruct a sequence of host activities, what is the most important factor to consider when examining multiple events in the Host Timeline?

The chronological order of the events

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 2Objective 1

2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 1)

Part of the Detection Analysis domain, which makes up ~10% of our current practice bank.

22questions here

5free pages

7concepts

Questions 1–5

1foundation · easy
A Falcon Hunter is reviewing the Host Timeline and sees a process creation event followed by a network connection event. What can be inferred from this sequence?
Select an answer first
2foundation · easy
In the Host Timeline, events are displayed with timestamps. How are events typically ordered in the default view?
Select an answer first
3application · medium
An analyst is investigating a malware infection. The Host Timeline shows a 'FileWrite' event at 10:00:00, a 'ProcessCreate' event at 10:00:05, and a 'NetworkConnect' event at 10:00:10. The analyst needs to determine the sequence of activities. Which interpretation is most accurate?
Select an answer first
4application · medium
An analyst is investigating a suspicious process on a host. The Host Timeline shows a 'ProcessCreate' event for the process. The analyst needs to understand what the process did after it was created. Which action should the analyst take to get this information?
Select an answer first
5foundation · easy
To reconstruct a sequence of host activities, what is the most important factor to consider when examining multiple events in the Host Timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.