Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

CrowdStrike CCFH-202b Exam - Topic 6 Question 15 Discussion

Which of the following is a suspicious process behavior?
D) Non-network processes (eg, notepad exe) making an outbound network connection
A) PowerShell running an execution policy of RemoteSigned
B) An Internet browser (eg, Internet Explorer) performing multiple DNS requests
C) PowerShell launching a PowerShell script

CrowdStrike CCFH-202b Exam - Topic 6 Question 15 Discussion

Actual exam question for CrowdStrike's CCFH-202b exam
Question #: 15
Topic #: 6
[All CCFH-202b Questions]

Which of the following is a suspicious process behavior?

Show Suggested Answer Hide Answer
Suggested Answer: D

Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.


Contribute your Thoughts:

0/2000 characters

Currently there are no comments in this discussion, be the first to comment!


Save Cancel