Explain What Information a Process Timeline Will Provide CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A responder is reviewing a Process Timeline and sees the following events: 09:00:00 - winlogon.exe creates userinit.exe; 09:00:01 - userinit.exe creates explorer.exe; 09:00:02 - explorer.exe creates cmd.exe; 09:00:03 - cmd.exe creates powershell.exe. The responder wants to determine if the cmd.exe and powershell.exe processes are part of the normal boot sequence. Which observation would best support the conclusion that they are NOT part of the normal boot sequence?

   • AThe parent-child relationships show that cmd.exe was spawned by explorer.exe, which is a normal part of the boot sequence.
   • BThe process termination events show that cmd.exe and powershell.exe ended quickly after being created.
   • CThe process creation events for cmd.exe and powershell.exe include command lines that reference suspicious scripts or executables.
   • DThe timestamps show that cmd.exe and powershell.exe were created within milliseconds of each other.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Falcon Responder is investigating a host where a legitimate user reported that their machine ran slowly and then displayed a ransomware note. The Process Timeline shows: explorer.exe (PID 1234) → cmd.exe (PID 5678) → powershell.exe (PID 9012) → ransomware.exe (PID 3456). The user claims they only double-clicked a PDF attachment. Which conclusion is best supported by this timeline?

   • AThe timeline proves that the user's claim is false because a PDF viewer would appear as the direct parent of ransomware.exe.
   • BThe parent-child chain shows that cmd.exe was launched by explorer.exe, which is consistent with a user double-clicking a file, but the subsequent PowerShell and ransomware execution indicates a multi-stage attack.
   • CThe ransomware.exe process is the parent of explorer.exe, proving that the ransomware was running before the user logged in.
   • DThe PDF viewer process spawned the entire chain, so the initial infection vector was the PDF viewer itself.
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A responder is using the Process Timeline to explain the attack flow to a colleague. The timeline shows a complex tree with many branches. The responder wants to highlight the main attack path. Which visual feature of the timeline is most useful for this purpose?

   • AThe parent-child lines connecting processes, which show the relationships and allow the responder to trace a specific path from root to leaf.
   • BThe timestamps on each event, which show the exact time of each action.
   • CThe process icons, which indicate the type of each process.
   • DThe color-coded event types, which distinguish between creation, termination, and injection.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement best describes the role of a Process Timeline in event investigation?

   • AIt lists all files that have been quarantined
   • BIt displays the current threat intelligence feed
   • CIt shows the sequence of process activity to help reconstruct what occurred on a host
   • DIt provides a real-time view of all user logins
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A junior analyst asks a Falcon Responder why the Process Timeline is a valuable starting point for an investigation. The responder explains that it provides a foundational view of what happened on the host. Which statement best describes the primary value of the Process Timeline in this context?

   • AIt shows a chronological sequence of process-related events, allowing the analyst to establish a baseline of activity before diving into other data sources.
   • BIt automatically identifies the root cause of the compromise without requiring further analysis.
   • CIt provides a complete record of all network connections made by every process.
   • DIt lists all files that were modified on the system during the incident.
   Reveal Solution Discussion Select an answer first