nerdexam
CrowdStrike

CCFH-202B · Question #64

Which of the following process trees should raise the most suspicion that adversary activity may be present on a web server?

The correct answer is D. WININIT.EXE >> SERVICES >> SVCHOST.EXE >> W3WP.EXE >> CMD.EXE. You've hit your limit · resets 12:50am (America/New_York)

Process Analysis and Investigation

Question

Which of the following process trees should raise the most suspicion that adversary activity may be present on a web server?

Options

  • ASMSS.EXE >> WINLOGON.EXE >> USERINIT.EXE >> EXPLORER.EXE >> WORD.EXE
  • BWINLOGON.EXE >> USERINIT.EXE >> EXPLORER.EXE >> OUTLOOK.EXE >>
  • CWININIT.EXE >> SERVICES >> SVCHOST.EXE >> TASKENG.EXE >> POWERSHELL.EXE
  • DWININIT.EXE >> SERVICES >> SVCHOST.EXE >> W3WP.EXE >> CMD.EXE

How the community answered

(46 responses)
  • A
    20% (9)
  • B
    11% (5)
  • C
    4% (2)
  • D
    65% (30)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#process tree analysis#web server#anomalous child processes#adversary activity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCFH-202B Practice