CrowdStrike

CCFR-201B · Question #39

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

The correct answer is C. Scheduled tasks registered prior to the detection. You've hit your limit · resets 12:50am (America/New_York)

Incident Response and Threat Investigation

Question

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options

AUser logons after the detection
BExecutions of schtasks.exe after the detection
CScheduled tasks registered prior to the detection
DPivot to a Hash search for taskeng.exe

How the community answered

(19 responses)

B
11% (2)
C
84% (16)
D
5% (1)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#taskeng.exe#scheduled tasks#schtasks.exe#threat investigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full CCFR-201B Practice