Explain What Information a Hosts Timeline Will Provide CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an investigation, a Falcon analyst reviews the Hosts Timeline for a compromised Linux server. The analyst sees an event that shows a new process spawned by an existing process, along with a network connection to an external IP. The analyst needs to determine which user account was associated with the process execution. Which detail from the timeline event would provide this information?

   • AThe 'File Path' field, which shows the location of the executable on disk.
   • BThe 'Parent Process ID' field, which identifies the parent process that spawned it.
   • CThe 'User' field in the event details, which shows the account context under which the process ran.
   • DThe 'Destination IP' field, which shows the external IP address of the network connection.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An analyst clicks on a 'NetworkConnection' event in the Hosts Timeline. Which detail would they expect to see in the event's metadata?

   • AThe host's BIOS version
   • BThe hash of the file that was downloaded
   • CThe destination IP address and port
   • DThe user's password hash
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An incident responder is using the Hosts Timeline to investigate a potential malware infection on a Windows host. The responder wants to see all events related to a specific file hash that was identified as malicious. Which filter should the responder apply?

   • AFilter by the hostname and time range only.
   • BFilter by the event type 'Network Connection' to see all network activity.
   • CFilter by the file hash in the 'Indicator' or 'File Hash' field.
   • DFilter by the user account that was active during the infection.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst sees a 'ProcessExecution' event followed by a 'FileWrite' event and then a 'NetworkConnection' event. What does this sequence suggest?

   • AThe user changed their password
   • BThe host is experiencing a hardware failure
   • CA possible sequence of actions that could indicate malicious behavior
   • DThe Falcon sensor is malfunctioning
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Falcon analyst is reviewing a Hosts Timeline for a Linux host and sees a process execution event for 'bash' with a command line that includes a base64-encoded string. The analyst decodes the string and finds a command that downloads and executes a script. The analyst wants to know which user executed the command and what the parent process was. Which fields should the analyst examine?

   • AThe 'Timestamp' and 'Hostname' fields in the event details.
   • BThe 'User' and 'Parent Process' fields in the event details.
   • CThe 'Network Connection' and 'File Hash' fields in the event details.
   • DThe 'Command Line' and 'File Path' fields in the event details.
   Reveal Solution Discussion Select an answer first