2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are analyzing a Process Timeline that spans several hours and contains hundreds of events. You need to focus on a 10-minute window where a specific detection occurred, but the timeline is too compressed to see individual events clearly. What should you do first?

   • ASwitch to the raw event log view to bypass the timeline entirely.
   • BExport the timeline to a CSV file for external analysis.
   • CFilter the timeline to show only processes with detection markers.
   • DUse the timeline zoom controls to expand the time range around the detection marker.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   While reviewing a Process Timeline for a compromised host, you notice that the detection marker appears on the parent process (a PowerShell window), but the child process (a spawned cmd.exe) executed several seconds later and shows no marker. The child then launched a second-stage payload. How should you interpret this sequence?

   • AThe detection marker on the parent is a false positive because the child executed without being flagged.
   • BThe detection is attributed to the parent process because the suspicious behavior originated there; the child is part of the same attack chain and should be examined for downstream activity.
   • CThe child process is benign because it lacks a detection marker; only the parent's activity was malicious.
   • DThe timeline is showing two unrelated events; the child process should be investigated as a separate incident.
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   You are new to the Falcon console and are looking at a Process Timeline for the first time. You see a horizontal line with process icons and connecting lines. What does the horizontal axis of the timeline represent?

   • AThe order of detection, with the first detection on the left.
   • BThe hierarchy of processes, with parents on the left and children on the right.
   • CTime, with events plotted chronologically from left to right.
   • DThe severity of events, with more severe events on the right.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the Process Timeline, how are parent-child process relationships typically depicted to help analysts understand process lineage?

   • AAs a pie chart showing process distribution
   • BAs a hierarchical tree structure showing the parent process above its child processes
   • CAs a flat list of processes sorted alphabetically
   • DAs color-coded icons on the timeline bar
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are investigating an incident and have a Process Timeline with many events. You want to see only the events that occurred after a specific detection. What is the most efficient way to do this?

   • AFilter the timeline to show only processes with detection markers.
   • BUse the timeline's time-range selector to set the start time to the detection time.
   • CManually scroll through the timeline to find the detection and note the events after it.
   • DExport the timeline and use a spreadsheet to filter by time.
   Reveal Solution Discussion Select an answer first