Which of the following is an example of an unusual parent-child relationship that might indicate malicious activity?

A web browser spawning a child process for a PDF viewer

An antivirus process spawning a scan worker process

A word processor spawning a command shell

A service control manager spawning a system service

When investigating a process tree, what is the primary purpose of examining the command-line arguments of a process?

To determine the network ports the process is listening on

To calculate the total memory usage of the process

To identify the user account that owns the process

To understand the specific actions the process was instructed to perform

In a process tree, what does the hierarchical relationship between processes represent?

The parent-child relationship, showing which process launched which

The chronological order in which processes were terminated

The privilege level of each process (user vs. system)

The network connections established by each process

You are investigating a suspicious process tree where svchost.exe is the parent of a wscript.exe process. The wscript.exe process has spawned multiple child processes, including cmd.exe and powershell.exe. Which approach best helps you understand the full scope of the activity?

Focus only on the wscript.exe process and its immediate children

Search for any files created by the wscript.exe process

Check the digital signatures of all executables in the tree

Review the command-line arguments of all processes in the tree and correlate with network and file events

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 7Objective 5

7.5 Investigate a Process Tree CCFH Practice Questions (Page 2)

Part of the Hunting Methodology domain, which makes up ~17% of our current practice bank.

24questions here

5free pages

4concepts

Questions 6–10

6foundation · easy
Which of the following is an example of an unusual parent-child relationship that might indicate malicious activity?
Select an answer first
7foundation · easy
When investigating a process tree, what is the primary purpose of examining the command-line arguments of a process?
Select an answer first
8foundation · easy
When correlating a process tree with related events, which type of event would provide the most insight into the network activity of a suspicious process?
Select an answer first
9foundation · easy
In a process tree, what does the hierarchical relationship between processes represent?
Select an answer first
10application · medium
You are investigating a suspicious process tree where svchost.exe is the parent of a wscript.exe process. The wscript.exe process has spawned multiple child processes, including cmd.exe and powershell.exe. Which approach best helps you understand the full scope of the activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.