Explain What Information a Process Timeline Will Provide CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A responder is presenting findings to a non-technical manager. The manager asks, 'How do you know the malware ran after the user opened the document?' The responder points to the Process Timeline. Which visual element of the timeline most directly supports the answer?

   • AThe process icons indicate which processes are known malware.
   • BThe vertical layout of the process tree shows the parent-child relationships.
   • CThe color-coded event types distinguish between process creation and termination.
   • DThe timestamps on each event show the exact time the document was opened and when the malware process was created.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When interpreting a Process Timeline, what does the order of events indicate?

   • AThe severity of each process event
   • BThe number of times each process has run
   • CThe user who initiated each process
   • DThe chronological execution flow of processes on the host
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an investigation, a responder notices that a process named 'notepad.exe' has a child process 'cmd.exe'. The responder suspects that notepad.exe was compromised. Which event in the Process Timeline would provide the strongest evidence of this compromise?

   • AAn injection event showing code being injected into notepad.exe.
   • BA process termination event showing notepad.exe ending.
   • CA process creation event showing notepad.exe creating cmd.exe.
   • DA process creation event showing cmd.exe creating notepad.exe.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In CrowdStrike Falcon Responder, what is the primary purpose of a Process Timeline?

   • ATo list all network connections made by a process
   • BTo show the current CPU and memory usage of running processes
   • CTo display a chronological sequence of process-related events on a host for investigation
   • DTo provide a summary of all files on the host
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Falcon console, how is a Process Timeline visually presented?

   • AAs a pie chart of process resource usage
   • BAs a table of file hashes
   • CAs a map of network connections
   • DAs a chronological list or tree of process events with timestamps
   Reveal Solution Discussion Select an answer first