4.5 Describe the Process Relationship of (Target/Parent/Context) CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   In a Falcon event search, you see a process tree where 'services.exe' spawned 'svchost.exe', which then spawned 'spoolsv.exe'. Which process is the parent of spoolsv.exe?

   • AThe user who started the service
   • Bservices.exe
   • Csvchost.exe
   • DThe Windows kernel
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When investigating a target process in Falcon, why is the command line context valuable?

   • AIt provides the IP address of the host
   • BIt reveals the exact arguments and options used to launch the process, which can indicate malicious intent
   • CIt shows the parent process's name
   • DIt indicates the user's password
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In Falcon event data, how is the relationship between a parent process and a child process represented?

   • AAs a one-to-one mapping where each process has exactly one child
   • BAs a flat list of processes with no inherent relationship
   • CAs a hierarchical tree where each process has a parent process (except the root) and can have multiple child processes
   • DAs a peer-to-peer network where processes are equal
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon event shows 'rundll32.exe' running with a command line that includes 'javascript:...' and the parent process is 'svchost.exe'. The host is a user workstation, and the user is 'jdoe'. Which contextual detail is most useful for determining if this is a malicious script execution?

   • AThe command line includes 'javascript:', which is a known technique for executing script via rundll32.exe.
   • BThe host is a user workstation, so the activity is expected.
   • CThe user is jdoe, a standard user, so the activity is likely benign.
   • DThe parent process is svchost.exe, which is a system process and therefore the activity is legitimate.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are analyzing a Falcon event where 'services.exe' (PID 1000) spawned 'svchost.exe' (PID 1100), which then spawned 'spoolsv.exe' (PID 1200). The command line for spoolsv.exe is '-k spool'. The user context is 'SYSTEM'. The host is a print server. Which process is the target process in the event that shows the command line '-k spool'?

   • Aservices.exe
   • BSYSTEM
   • Csvchost.exe
   • Dspoolsv.exe
   Reveal Solution Discussion Select an answer first