2.2 Analyze the Information Displayed in the Process Timeline to Understand the Flow of Events and Detections CCFH Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   You are analyzing a Process Timeline and see that a process (e.g., explorer.exe) spawns a child process (e.g., cmd.exe). The child process then exits quickly. What does this sequence suggest?

   • AThe parent process is compromised and should be blocked.
   • BThe child process may have executed a command and then terminated, which could be benign or malicious.
   • CThe child process is a false positive and can be ignored.
   • DThe timeline is showing an error.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the CrowdStrike Falcon console, which component of the Process Timeline provides a visual, horizontal representation of the sequence of process activity over time?

   • AThe timeline bar
   • BThe detection details pane
   • CThe process tree diagram
   • DThe event list panel
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   When analyzing the flow of events in the Process Timeline, what should an analyst look for to identify the initial entry point of an attack?

   • AThe process with the most child processes
   • BThe earliest process or event in the sequence that is associated with suspicious activity
   • CThe last event in the timeline
   • DThe process with the longest name
   Reveal Solution Discussion Select an answer first