CrowdStrike CCFR-201b Exam - Topic 5 Question 1 Discussion

Actual exam question for CrowdStrike's CCFR-201b exam

Question #: 1
Topic #: 5

[All CCFR-201b Questions]

How does a DNSRequest event link to its responsible process?

AVia both its ContextProcessld__decimal and ParentProcessld_decimal fields

BVia its ParentProcessld_decimal field

CVia its ContextProcessld_decimal field

DVia its TargetProcessld_decimal field

Show Suggested Answer

Suggested Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2.The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2.The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2.You can use this field to trace the process lineage and identify malicious or suspicious activities2.

by Marla at Jan 24, 2026, 11:27 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rex

8 days ago

I'm not entirely sure, but I remember something about ParentProcessId being crucial in linking events to processes. Maybe it's B?

upvoted 0 times

...

Mindy

13 days ago

I think the answer might be A, since it mentions both ContextProcessId and ParentProcessId, which seems more comprehensive.

upvoted 0 times

...

Tina

18 days ago

I'm a bit confused on this one. I'm not entirely sure how the different process ID fields are used to connect the event to the process. I'll need to review my notes carefully.

upvoted 0 times

...

Arleen

23 days ago

I've seen questions like this before. I think the answer is in option C - the ContextProcessld_decimal field is the one that links the DNSRequest event to the responsible process.

upvoted 0 times

...

Roselle

28 days ago

Okay, let's see. I'm pretty sure it has to do with the process ID fields, but I'm not sure which one is the right one. I'll have to think this through step-by-step.

upvoted 0 times

...

Thurman

1 month ago

Hmm, this one seems a bit tricky. I'll need to carefully review the options and think through the relationship between the DNSRequest event and the process.

upvoted 0 times

...

Cherry

1 month ago

I think the key here is to understand how the DNSRequest event is linked to the responsible process. The question is asking about the specific fields that connect the two.

upvoted 0 times

...