2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are analyzing a Process Timeline and notice a pattern: a legitimate application (e.g., a document editor) spawns a child process that is not typical for that application. The child process then attempts to access the network. What does this pattern suggest?

   • AThe application may be compromised or abused to execute malicious code.
   • BThe child process is a false positive and can be ignored.
   • CThe application is performing a routine update.
   • DThe application is malfunctioning and needs to be reinstalled.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   You are analyzing a Process Timeline and see a process (e.g., svchost.exe) that has spawned multiple child processes. One of the children is a known malicious process, but the others appear benign. What should you do?

   • AInvestigate all child processes, as the malicious one may have influenced the others.
   • BAssume the benign children are false positives and move on.
   • CIgnore the benign-looking children and focus only on the malicious one.
   • DBlock the parent process (svchost.exe) to prevent further activity.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are investigating a detection that occurred at 10:00 AM. The Process Timeline shows events from 9:00 AM to 11:00 AM. You need to determine if there were any precursor events before the detection. What is the most effective way to do this?

   • AExpand the timeline to start earlier than 9:00 AM to see if there are any events before the detection.
   • BExport the timeline and analyze it in a spreadsheet.
   • CFilter the timeline to show only processes with detection markers.
   • DLook at the events immediately before the detection marker in the current view.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When interpreting the chronological sequence of events in the Process Timeline, what does the left-to-right ordering of events on the timeline bar represent?

   • AThe order of process hierarchy, from parent to child
   • BThe severity of events, from least to most severe
   • CThe alphabetical order of process names
   • DThe order in which events were recorded, from earliest to latest
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of analyzing the flow of events in the Process Timeline during a detection investigation?

   • ATo understand the sequence of actions and identify the overall attack pattern
   • BTo verify that the Falcon sensor is working correctly
   • CTo count the total number of processes on the host
   • DTo determine the IP address of the attacker
   Reveal Solution Discussion Select an answer first