CrowdStrike
CCFR-201B · Question #10
When examining a raw DNS request event, you see a field called ContextProcessId_decimal. What is the purpose of that field?
The correct answer is D. It contains the TargetProcessId_decimal value for the process that made the DNS request. ContextProcessId of DnsRequest event is equal to the TargetProcessId of the event that spawned the DnsRequest event.
Event Data Analysis and Investigation
Question
When examining a raw DNS request event, you see a field called ContextProcessId_decimal. What is the purpose of that field?
Options
- AIt contains the TargetProcessId_decimal value for other related events
- BIt contains an internal value not useful for an investigation
- CIt contains the ContextProcessId decimal value for the parent process that made the DNS request
- DIt contains the TargetProcessId_decimal value for the process that made the DNS request
How the community answered
(42 responses)- A7% (3)
- B5% (2)
- C17% (7)
- D71% (30)
Explanation
ContextProcessId of DnsRequest event is equal to the TargetProcessId of the event that spawned the DnsRequest event.
Topics
#DNS request event#ContextProcessId_decimal#raw event data#process identification
Community Discussion
No community discussion yet for this question.