2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Within the Process Timeline layout, where does the Falcon console display the specific actions (such as file writes, network connections, and registry modifications) that occurred for a selected process?

   • AIn the alert summary section
   • BOn the horizontal timeline bar
   • CIn the event list panel
   • DIn the process tree diagram
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are analyzing a Process Timeline for a host that was compromised. The timeline shows a series of events: a process (e.g., wscript.exe) runs a script, which then spawns powershell.exe. Powershell.exe then spawns a process that connects to an external IP address. You need to determine if this is a single attack or multiple attacks. What is the best way to do this?

   • AExamine the timeline for any gaps or changes in the attack pattern that would indicate separate attacks.
   • BBlock the external IP address and consider the investigation complete.
   • CAssume it is a single attack because the processes are related.
   • DFocus only on the network connection and ignore the earlier processes.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   You are analyzing a Process Timeline for a host that was compromised. The timeline shows the following sequence: a user opens a phishing document (winword.exe), which spawns powershell.exe. Powershell.exe then spawns cmd.exe, which runs a script that downloads a payload. The payload then executes and establishes persistence. You need to identify the earliest point where you could have potentially stopped the attack. Where is that point?

   • AAt the winword.exe process, because it is the initial entry point.
   • BAt the payload execution, because that is when the malware is actually installed.
   • CAt the powershell.exe process, because it is the first suspicious process.
   • DAt the cmd.exe process, because it is the first to execute a script.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   You are reviewing a Process Timeline and see a detection marker on a process. However, the process's parent is not shown in the timeline. What does this indicate?

   • AThe parent process may have exited before the timeline was captured, or the parent is outside the current view.
   • BThe timeline is corrupted and needs to be regenerated.
   • CThe process is a root process with no parent.
   • DThe process is malicious and its parent was hidden by the attacker.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   You are analyzing a Process Timeline and see that a process (e.g., rundll32.exe) has multiple child processes. What does this indicate?

   • AThe process is a system process and should be ignored.
   • BThe process is performing multiple actions or is being used to launch several components.
   • CThe process is a parent of itself, indicating a loop.
   • DThe process is a false positive and the children are benign.
   Reveal Solution Discussion Select an answer first