CCFH-202B · Question #47
The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?
The correct answer is C. ParentProcessld_decimal. The ParentProcessld_decimal event field is what the Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns with when the cloudable Event data contains it. The ParentProcessld_decimal event field is the decimal representation of the…
Question
The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?
Options
- AContextProcessld_decimal
- BRawProcessld_decimal
- CParentProcessld_decimal
- DRpcProcessld_decimal
How the community answered
(19 responses)- B5% (1)
- C84% (16)
- D11% (2)
Explanation
The ParentProcessld_decimal event field is what the Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns with when the cloudable Event data contains it. The ParentProcessld_decimal event field is the decimal representation of the process identifier for the parent process of the target process. It can be used to trace the process ancestry and identify potential malicious activity. The ContextProcessld_decimal, RawProcessld_decimal, and RpcProcessld_decimal event fields are not used to populate the Parent Process ID and the Parent File columns.
Topics
Community Discussion
No community discussion yet for this question.