CrowdStrike Exam CCFR-201 Topic 3 Question 27 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 27
Topic #: 3

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

AIt contains the TargetProcessld_decimal value for other related events

BIt contains an internal value not useful for an investigation

CIt contains the ContextProcessld_decimal value for the parent process that made the DNS request

DIt contains the TargetProcessld_decimal value for the process that made the DNS request

Show Suggested Answer

Suggested Answer: D

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1.This field can be used to trace the process lineage and identify malicious or suspicious activities1.For a DNS request event, this field indicates which process made the DNS request1.

by Dominque at Sep 14, 2024, 10:27 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Viola

6 days ago

B has to be the right answer. An 'internal value not useful for an investigation' sounds like the kind of cryptic field that security tools love to include. #JustSecurityThings

upvoted 0 times

...

Anna

8 days ago

I'm going with D. The TargetProcessld_decimal value for the process that made the DNS request seems like the most relevant information to have in this field.

upvoted 0 times

...

Broderick

10 days ago

I'm not sure, but I think it might be related to the TargetProcessId_decimal value for other related events.

upvoted 0 times

...

Curtis

18 days ago

I agree with Laurel. It makes sense that it would link back to the parent process.

upvoted 0 times

...

Laurel

20 days ago

I think the purpose of the ContextProcessId_decimal field is to contain the ContextProcessId_decimal value for the parent process that made the DNS request.

upvoted 0 times

...

Verona

22 days ago

I think it's C. The ContextProcessld_decimal field should contain the parent process that made the DNS request, not the target process. That makes the most sense in the context of a DNS event.

upvoted 0 times

Bettye

5 days ago

I think it's C. The ContextProcessld_decimal field should contain the parent process that made the DNS request, not the target process. That makes the most sense in the context of a DNS event.

upvoted 0 times

...