Analyze Process Relationships (parent/child/sibling) Using the Information Contained in the Full Detection Details CCFR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the Full Detection Details, two processes are shown as siblings. What does this indicate about their relationship?

   • AThey are running on the same host and have the same PID.
   • BThey are the same process running in different threads.
   • CThey are both children of the same parent process.
   • DThey are both parent processes of the same child.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are reviewing a detection where the process tree shows 'lsass.exe' (PID 600, PPID 500) and 'svchost.exe' (PID 700, PPID 500). You also see 'svchost.exe' (PID 700) spawning 'powershell.exe' (PID 800). The command line of powershell.exe includes a script that connects to an external IP address. What is the most significant finding in this process tree?

   • AThe fact that lsass.exe and svchost.exe are siblings, which is unusual.
   • BThe external IP connection from powershell.exe, which indicates potential command and control communication.
   • CThe spawning of powershell.exe by svchost.exe, which is always malicious.
   • DThe presence of lsass.exe, which is a high-value target for credential theft.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are investigating a detection where the process tree shows 'explorer.exe' (PID 1000, PPID 900) spawning 'cmd.exe' (PID 1100). The command line of cmd.exe shows it is running 'ipconfig /all'. You also see 'cmd.exe' (PID 1100) spawning 'whoami.exe' (PID 1200). What is the most likely interpretation of this chain?

   • AThis is a normal administrative task because ipconfig and whoami are legitimate commands.
   • BThe chain is benign because explorer.exe is the parent.
   • CThis is a reconnaissance activity where an attacker is gathering network and user information.
   • Dwhoami.exe is the most suspicious process because it is the last in the chain.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   In the Full Detection Details, you see the following process tree: 'wininit.exe' (PID 400) → 'services.exe' (PID 500) → 'svchost.exe' (PID 600). You also see 'svchost.exe' (PID 601) with PPID 500. What is the relationship between svchost.exe (PID 600) and svchost.exe (PID 601)?

   • Asvchost.exe (PID 601) is a child of wininit.exe.
   • Bsvchost.exe (PID 600) is the parent of svchost.exe (PID 601).
   • CThey are siblings because they share the same parent, services.exe.
   • DThey are unrelated because they have different PIDs.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are investigating a detection where the process tree shows 'outlook.exe' spawning 'cmd.exe', which then spawned 'regsvr32.exe'. The command line of regsvr32.exe includes a URL to an external site. What does the sequence of process executions suggest about the nature of the activity?

   • AThis is a suspicious chain where a document reader spawned a shell, which then executed a scriptlet from a remote URL.
   • Boutlook.exe is the most suspicious process because it initiated the chain.
   • CThe relationship is benign because cmd.exe is a trusted system process.
   • DThis is normal behavior because regsvr32.exe is a legitimate Windows binary.
   Reveal Solution Discussion Select an answer first