Explain What Information a Process Timeline Will Provide CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon Responder is investigating a host where a user reports that their machine was compromised after clicking a link in an email. The Process Timeline shows: outlook.exe → cmd.exe → powershell.exe → malware.exe. The responder needs to determine the initial execution vector. Which conclusion is best supported by the timeline?

   • AThe initial vector was a malicious attachment, as evidenced by the chain starting from outlook.exe.
   • BThe initial vector was the user manually launching cmd.exe from the Start menu.
   • CThe initial vector was the email link, as evidenced by outlook.exe being the root process.
   • DThe initial vector cannot be determined from the timeline alone, but the chain from outlook.exe to cmd.exe is consistent with the user clicking a link or opening an attachment.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A responder is reviewing a Process Timeline and notices that a process named 'svchost.exe' has a child process 'cmd.exe'. The responder suspects this is unusual. Which data source in the timeline would provide the most context to confirm this suspicion?

   • AThe injection event for cmd.exe, which shows if code was injected into the process.
   • BThe timestamp of the cmd.exe creation event, which shows the exact time it was launched.
   • CThe process creation event for cmd.exe, which includes the command line used to launch it.
   • DThe process termination event for svchost.exe, which shows when the parent process ended.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can a Process Timeline support an event investigation?

   • ABy providing a list of all users on the host
   • BBy helping to trace the attack path from initial execution to later activity
   • CBy automatically blocking malicious processes
   • DBy showing the current threat level of the host
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What type of relationship can a Process Timeline reveal between two processes?

   • AParent-child relationship
   • BNetwork connection relationship
   • CFile ownership relationship
   • DUser group relationship
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a Process Timeline, if Process A appears before Process B, what can you infer?

   • AProcess A started before Process B
   • BProcess A is a parent of Process B
   • CProcess A is more malicious than Process B
   • DProcess A has a higher process ID than Process B
   Reveal Solution Discussion Select an answer first