CrowdStrike

CCFR-201B · Question #20

When examining raw event data, what is the purpose of the field called ParentProcessId_decimal?

The correct answer is D. It contains the TargetProcessId_decimal of the parent process. You've hit your limit · resets 12:50am (America/New_York)

Event Data Analysis and Investigation

Question

When examining raw event data, what is the purpose of the field called ParentProcessId_decimal?

Options

AIt contains an internal value not useful for an investigation
BIt contains the TargetProcessId_decimal value of the child process
CIt contains the SensorId_decimal value for related events
DIt contains the TargetProcessId_decimal of the parent process

How the community answered

(37 responses)

A
3% (1)
B
3% (1)
C
5% (2)
D
89% (33)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#ParentProcessId_decimal#raw event data#parent process#process relationships

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full CCFR-201B Practice