2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   In a Process Timeline, you observe the following sequence: svchost.exe spawns wscript.exe, which then spawns powershell.exe. The powershell.exe process downloads and executes a payload. Which process is the direct parent of powershell.exe?

   • AThe user who logged in
   • BThe payload executable
   • Cwscript.exe
   • Dsvchost.exe
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   You are reviewing a Process Timeline and want to see the details of a specific event, such as the command line of a process. What should you do?

   • AClick on the process in the timeline to view its details.
   • BFilter the timeline to show only processes with command lines.
   • CExport the timeline to a text file to see the command line.
   • DUse the search function to find the command line.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   You are reviewing a Process Timeline and see a red detection marker on a process. What does this marker indicate in the context of the timeline?

   • AThe process triggered a detection and is the focus of the alert.
   • BThe process is a known benign system process.
   • CThe process has been terminated by the administrator.
   • DThe process is a child of a detected process.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does the CrowdStrike Falcon console visually highlight processes or events that are associated with a detection within the Process Timeline?

   • ABy enlarging the process icons
   • BBy displaying them with a distinct color or marker
   • CBy moving them to the top of the timeline bar
   • DBy adding a text label next to every event
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are reviewing a Process Timeline and see a detection marker on a process. However, the process is a child of a process that is also marked. What does this indicate?

   • AThe timeline is showing duplicate detections.
   • BThe child process is a false positive because the parent is already marked.
   • CThe parent process is the only one that needs to be investigated.
   • DBoth the parent and child processes triggered detections, indicating a multi-stage attack.
   Reveal Solution Discussion Select an answer first