2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An analyst sees that Process B is displayed as a child of Process A in the Process Timeline. What does this relationship indicate about Process B?

   • AProcess B has the same name as Process A
   • BProcess B is a newer version of Process A
   • CProcess B was started by Process A
   • DProcess B terminated Process A
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   To inspect events that occurred just before a detection in the Process Timeline, what is the most direct navigation technique?

   • ARestart the Falcon sensor on the host
   • BExport the timeline to a PDF file
   • CScroll or pan the timeline to position the detection marker in view and examine preceding events
   • DClick the detection marker to delete it
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are reviewing a Process Timeline and see a detection marker on a process. However, the process's behavior appears to be normal (e.g., it is a standard system process). What is the most likely explanation?

   • AThe process may be exhibiting behavior that is suspicious in context, even if it appears normal in isolation.
   • BThe timeline is showing incorrect data.
   • CThe process is a system process and should not be flagged.
   • DThe detection is a false positive and can be dismissed.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When a process in the Process Timeline is associated with a detection, what visual cue might the analyst see to indicate this association?

   • AAn animated blinking icon
   • BA strikethrough on the process name
   • CA grayed-out appearance
   • DA colored highlight or badge on the process node
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which action in the Falcon console allows an analyst to narrow the Process Timeline view to a specific time window of interest?

   • ADragging the time range selector on the timeline bar
   • BDeleting unrelated events from the list
   • CRenaming the process in the tree
   • DChanging the color theme of the console
   Reveal Solution Discussion Select an answer first