4.5 Describe the Process Relationship of (Target/Parent/Context) CCFH Practice Questions (Page 4)

Questions 16–16

1. 16expert · hard

   You are investigating an alert on a user workstation. The event shows 'mshta.exe' (PID 500) was spawned by 'outlook.exe' (PID 400). The command line for mshta.exe includes 'javascript:...'. The user is 'jsmith'. The host is a finance laptop. Which combination of context is most important to determine if this is a malicious macro or script execution?

   • AThe parent process (outlook.exe) and the command line (javascript:) are the most important because they indicate a script executed from an email client.
   • BThe host name and the user name are the most important because they indicate the scope of the compromise.
   • CThe process ID (500) and the parent process ID (400) are the most important because they confirm the process tree.
   • DThe user (jsmith) and the host (finance laptop) are the most important because they indicate a high-value target.
   Reveal Solution Discussion Select an answer first