Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 5

The command line shows certutil being used to retrieve an archive from an external URL. Although this is suspicious, the immediate investigative question is how certutil was launched. The detection’s process tree supplies that context by showing parent-child relationships, command lines, users, and related activity. Identifying the parent process can reveal whether execution originated from a browser, Office application, script interpreter, scheduled task, service, or interactive shell. Logon events and firewall settings may become relevant later, but they do not directly establish the execution chain. An on-demand scan may find malicious files, yet it will not explain the initiating process. Reviewing the process tree first is therefore the most direct way to determine what executed certutil and how the behavior began.

================

Process Timeline is the intended investigative view because it lets a responder examine the process execution and the process-related telemetry surrounding it within the selected time window. This is useful for identifying nearby process starts and other events that explain what happened before and after the suspicious activity. A general Host Search returns information organized by categories, but it is not the focused chronological view requested here. Full Detection Details primarily shows the process ancestry and relationships associated with the detection, rather than every relevant event around the selected execution. “Process Search” is not the appropriate timeline workflow described by the Falcon Responder material. Therefore, the best answer is to open a Process Timeline and apply the host and time context.

================