An Event Search returns a single event showing a process 'powershell.exe' with a suspicious encoded command. The analyst wants to see if this process has a history of similar activity on the host. Which tool should the analyst pivot to?

Event Search with a different query

An Event Search returns a single process execution event for a known legitimate application, but the event shows the process ran from a non-standard directory. What does this Event Search result indicate?

The process should be immediately terminated.

The event is a false positive and requires no further action.

The event warrants deeper investigation into the process.

The event is normal and can be archived.

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 4Objective 3

Understand When to Pivot to a Process Timeline or Process Explorer from an Event Search CCFR Practice Questions (Page 2)

Part of the Event Investigation domain, which makes up ~14% of our current practice bank.

9questions here

2free pages

4concepts

Questions 6–9

6foundation · easy
An analyst needs to determine whether a process has been running continuously for the past week and what it did during that time. Which tool is the best choice for this investigation?
Select an answer first
7application · medium
An Event Search returns a single event showing a process 'powershell.exe' with a suspicious encoded command. The analyst wants to see if this process has a history of similar activity on the host. Which tool should the analyst pivot to?
Select an answer first
8foundation · easy
An analyst is investigating a process that is currently running and needs to see its real-time CPU and memory usage. Which tool should the analyst use?
Select an answer first
9foundation · easy
An Event Search returns a single process execution event for a known legitimate application, but the event shows the process ran from a non-standard directory. What does this Event Search result indicate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Understand When to Pivot to a Process Timeline or Process Explorer from an Event Search CCFR Practice Questions (Page 2)

Questions 6–9

An analyst needs to determine whether a process has been running continuously for the past week and what it did during that time. Which tool is the best choice for this investigation?

An Event Search returns a single event showing a process 'powershell.exe' with a suspicious encoded command. The analyst wants to see if this process has a history of similar activity on the host. Which tool should the analyst pivot to?

An analyst is investigating a process that is currently running and needs to see its real-time CPU and memory usage. Which tool should the analyst use?

An Event Search returns a single process execution event for a known legitimate application, but the event shows the process ran from a non-standard directory. What does this Event Search result indicate?

Keep studying — Event Investigation