Analyze Process Relationships (parent/child/sibling) Using the Information Contained in the Full Detection Details CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the Full Detection Details, which metadata field is used to identify the parent of a given process?

   • APID (Process Identifier)
   • BCommand line
   • CSHA256 hash
   • DPPID (Parent Process Identifier)
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are investigating a detection where the process tree shows 'powershell.exe' (PID 2000, PPID 1500) spawning 'cmd.exe' (PID 2100). The process with PID 1500 is 'explorer.exe'. However, the command line of powershell.exe shows it was launched with '-EncodedCommand'. You also notice that 'cmd.exe' (PID 2100) spawned 'whoami.exe' (PID 2200). What is the most significant indicator of malicious activity in this chain?

   • AThe spawning of cmd.exe by powershell.exe, which is never legitimate.
   • BThe execution of whoami.exe, which is a reconnaissance command.
   • CThe use of -EncodedCommand in powershell.exe, which is a common obfuscation technique.
   • DThe fact that explorer.exe spawned powershell.exe, which is always malicious.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the Full Detection Details, which piece of process metadata is most useful for understanding what arguments were passed to a process when it was launched?

   • APPID
   • BCommand line
   • CPID
   • DUser SID
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are reviewing a detection where the process tree shows 'wscript.exe' (PID 1000) spawning 'cmd.exe' (PID 1100), which then spawned 'powershell.exe' (PID 1200). The command line of wscript.exe includes a reference to a .vbs file in the user's Downloads folder. What is the most likely interpretation of this process chain?

   • AThis is a normal administrative task because wscript.exe and cmd.exe are legitimate Windows tools.
   • Bpowershell.exe is the most suspicious process because it is the last in the chain.
   • CThe relationship is benign because the processes are in a linear chain.
   • DA script from the Downloads folder initiated a chain that led to PowerShell, indicating a likely malicious script execution.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When reading the process tree in the Full Detection Details, what does a branch from a parent node to multiple child nodes indicate?

   • AThe parent process spawned multiple child processes.
   • BThe parent process has multiple threads.
   • CThe parent process is running on multiple hosts.
   • DThe parent process was terminated and restarted.
   Reveal Solution Discussion Select an answer first