Explain What Information a Hosts Timeline Will Provide CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident responder is analyzing a Hosts Timeline for a compromised Windows host. The timeline shows a process execution event for 'powershell.exe' followed by a file write event to the startup folder. The responder wants to determine if the file write was performed by the PowerShell process. What should the responder do?

   • AFilter the timeline to show only file write events and ignore process executions.
   • BSearch the timeline for 'powershell.exe' and review only those events.
   • CExport the timeline to a CSV and manually compare the timestamps.
   • DExamine the parent process of the file write event to see if it matches the PowerShell process.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An incident responder is analyzing a Hosts Timeline for a compromised Windows host. The timeline shows the following sequence: (1) a PowerShell process executes a script, (2) the script writes a file to the startup folder, (3) the host makes a network connection to an external IP, and (4) a new process runs from the written file. The responder needs to confirm the attack chain. What is the best way to use the Hosts Timeline to confirm this sequence?

   • AFilter the timeline to show only network connections and ignore process and file events.
   • BExport the timeline to a PDF and share it with the team for manual review.
   • CSearch for the external IP in the timeline and review only those events.
   • DReview the events in chronological order, correlating the parent-child process relationships and file writes to the network connection.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Falcon analyst is reviewing a Hosts Timeline for a Windows host and sees a process execution event for 'cmd.exe'. The event details show a timestamp, a user, a parent process, and a command line. The analyst wants to know which process launched 'cmd.exe'. Which field should the analyst examine?

   • AThe 'Parent Process' field, which shows the process that spawned 'cmd.exe'.
   • BThe 'Timestamp' field, which shows when the process executed.
   • CThe 'Command Line' field, which shows the arguments passed to 'cmd.exe'.
   • DThe 'User' field, which shows the account under which 'cmd.exe' ran.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does the Hosts Timeline support incident investigation?

   • ABy providing a list of all users in the organization
   • BBy automatically remediating all detected threats
   • CBy generating a compliance report for auditors
   • DBy helping identify suspicious activity and establish a timeline of compromise
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Falcon administrator is investigating a single Windows endpoint that reportedly exhibited unusual behavior. The administrator opens the Hosts Timeline for that host and notices that the timeline aggregates process executions, network connections, file writes, and authentication events. The administrator needs to quickly identify which events occurred around the time of the reported anomaly. What is the most efficient way to use the Hosts Timeline to accomplish this?

   • AOpen the Event Search module and query for all events on the host without specifying a time range.
   • BSearch the timeline for the specific process name that was reported as unusual, ignoring other event types.
   • CApply a time-range filter to narrow the timeline to the reported anomaly window, then review the aggregated events in chronological order.
   • DExport the entire timeline to a CSV file and open it in a spreadsheet to manually sort by timestamp.
   Reveal Solution Discussion Select an answer first