4.5 Describe the Process Relationship of (Target/Parent/Context) CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a Falcon event search, which element is considered the 'Parent' in the Target/Parent/Context relationship?

   • AThe command line used to launch the target process
   • BThe process that spawned or initiated the target process
   • CThe host where the target process is running
   • DThe user account that owns the target process
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are analyzing a Falcon event where 'wmiprvse.exe' (PID 100) spawned 'cmd.exe' (PID 200), which then spawned 'powershell.exe' (PID 300). The command line for powershell.exe includes an encoded command. The user context is 'svc_backup'. The host is a file server. Which process is the target process in the event that shows the encoded command?

   • Asvc_backup
   • Bpowershell.exe
   • Ccmd.exe
   • Dwmiprvse.exe
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a Falcon event search, when analyzing a process event, what does the 'Target' typically represent?

   • AThe host machine on which the event occurred
   • BThe command line arguments passed to the process
   • CThe process that was executed or performed the action recorded in the event
   • DThe user account that initiated the process
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   In a Falcon event search, you see a process tree where 'userinit.exe' spawned 'explorer.exe', which then spawned 'cmd.exe'. Which process is the direct parent of cmd.exe?

   • AThe user who logged in
   • BThe Windows session manager
   • Cuserinit.exe
   • Dexplorer.exe
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a Falcon event search, which of the following is an example of contextual information that helps enrich the understanding of a target process's behavior?

   • AThe process's internal memory allocation
   • BThe process's CPU cache usage
   • CThe user account associated with the process
   • DThe process's network packet payload
   Reveal Solution Discussion Select an answer first