Analyze Process Relationships (parent/child/sibling) Using the Information Contained in the Full Detection Details CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are investigating a detection where the process tree shows 'svchost.exe' (PID 700) spawning 'dllhost.exe' (PID 800). The command line of dllhost.exe includes a reference to a COM object. You also notice that svchost.exe (PID 700) was spawned by 'services.exe' (PID 500). What is the most accurate description of the process tree?

   • AThe COM object reference in dllhost.exe makes it the parent of svchost.exe.
   • Bservices.exe is the grandparent of dllhost.exe, and svchost.exe is its parent.
   • Cdllhost.exe is a sibling of svchost.exe because they are both spawned by services.exe.
   • Dsvchost.exe is the root of the tree, and dllhost.exe is its child.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the Full Detection Details of the Falcon console, a process is shown as a direct child of another process. What does this relationship indicate?

   • AThe child process was created by the parent process.
   • BThe child process is running on the same host as the parent but has no execution link.
   • CThe child process is the parent process after it has been renamed.
   • DThe child process is a copy of the parent process running in a different session.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the process tree visualization of the Full Detection Details, what does the topmost node typically represent?

   • AThe process that was flagged as malicious by Falcon.
   • BThe process that initiated the execution chain shown in the tree.
   • CThe most recently executed process in the detection.
   • DThe process with the highest CPU usage in the detection.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an investigation, you find a process 'msiexec.exe' with PID 1234 and PPID 5678. The process with PID 5678 is 'explorer.exe'. However, the command line of msiexec.exe shows it was launched from a temporary directory. What does this combination of metadata suggest?

   • AThe parent-child relationship is legitimate, but the command line from a temp directory is suspicious and warrants further investigation.
   • Bmsiexec.exe is a sibling of explorer.exe because they have different PIDs.
   • CThe command line is irrelevant because the parent-child relationship is what matters.
   • DThe relationship is definitely malicious because msiexec.exe should never be spawned by explorer.exe.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are reviewing a detection where the process tree shows 'explorer.exe' (PID 1000) with two children: 'cmd.exe' (PID 2000) and 'rundll32.exe' (PID 2001). Both child processes have the same parent PID. What does this structure indicate about the relationship between cmd.exe and rundll32.exe?

   • Acmd.exe is the parent of rundll32.exe because it was spawned first.
   • BThey are unrelated processes that happen to be grouped together in the tree.
   • CThey are sibling processes because they share the same parent, explorer.exe.
   • Drundll32.exe is a child of cmd.exe, forming a chain.
   Reveal Solution Discussion Select an answer first