Which event type is most likely to appear in a Process Timeline?

A process spawning a child process

During an investigation, a Process Timeline can help an analyst identify which of the following?

Suspicious process activity, such as an unknown process spawning from a trusted application

The current network bandwidth usage

The physical location of the host

The list of installed software licenses

Which association between processes is most directly revealed by a Process Timeline?

Which processes have the same file size

Which process was started by another process

Which processes are running on the same CPU core

Which processes share the same icon

While reviewing a Process Timeline for a compromised server, a responder notices that a process named svchost.exe appears multiple times with different PIDs. Between two of these entries, there is a gap of several seconds with no events. Which data source is most likely to explain the gap?

The gap indicates that the Falcon sensor was temporarily disconnected from the host.

The gap represents a period where the process was suspended and not generating any events.

The gap is caused by the process running without any process creation, termination, or injection events occurring during that time.

Process termination events are not recorded for svchost.exe because it is a trusted Microsoft binary.

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 4Objective 1

Explain What Information a Process Timeline Will Provide CCFR Practice Questions (Page 1)

Part of the Event Investigation domain, which makes up ~14% of our current practice bank.

22questions here

5free pages

6concepts

Questions 1–5

1foundation · easy
Which event type is most likely to appear in a Process Timeline?
Select an answer first
2foundation · easy
During an investigation, a Process Timeline can help an analyst identify which of the following?
Select an answer first
3foundation · easy
Which association between processes is most directly revealed by a Process Timeline?
Select an answer first
4application · medium
While reviewing a Process Timeline for a compromised server, a responder notices that a process named svchost.exe appears multiple times with different PIDs. Between two of these entries, there is a gap of several seconds with no events. Which data source is most likely to explain the gap?
Select an answer first
5foundation · easy
Which key element is typically displayed for each event in a Process Timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.