Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

CrowdStrike CCFR-201b Exam - Topic 5 Question 1 Discussion

Actual exam question for CrowdStrike's CCFR-201b exam

Question #: 1
Topic #: 5

[All CCFR-201b Questions]

How does a DNSRequest event link to its responsible process?

AVia both its ContextProcessld__decimal and ParentProcessld_decimal fields

BVia its ParentProcessld_decimal field

CVia its ContextProcessld_decimal field

DVia its TargetProcessld_decimal field

Show Suggested Answer

Suggested Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2.The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2.The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2.You can use this field to trace the process lineage and identify malicious or suspicious activities2.

by Marla at Jan 24, 2026, 11:27 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Domonique

29 days ago

I disagree, C is too simplistic for this scenario.

upvoted 0 times

...

Mona

1 month ago

Wait, is it really both? That seems a bit much.

upvoted 0 times

...

Remedios

1 month ago

I’m with Nan on this one, A makes the most sense.

upvoted 0 times

...

Desmond

1 month ago

I think it's just B, the ParentProcessId is key.

upvoted 0 times

...

Nan

2 months ago

It's definitely A, both fields are involved.

upvoted 0 times

...

Lindsey

2 months ago

Hmm, this question is as clear as mud. I'll just guess and hope for the best.

upvoted 0 times

...

Dottie

2 months ago

A) Via both its ContextProcessld__decimal and ParentProcessld_decimal fields. Makes the most sense.

upvoted 0 times

...

Theron

2 months ago

D) Via its TargetProcessld_decimal field. Sounds legit to me.

upvoted 0 times

...

Gladys

2 months ago

B) Via its ParentProcessld_decimal field. Gotta be that one.

upvoted 0 times

...

Micah

3 months ago

C) Via its ContextProcessld_decimal field. That's the correct answer, I'm sure of it.

upvoted 0 times

...

Major

3 months ago

I’m leaning towards A as well, but I wonder if TargetProcessId has any relevance here. It’s a bit confusing!

upvoted 0 times

...

Therese

3 months ago

I feel like I’ve seen a similar question before, and it focused on ContextProcessId. Could it be C?

upvoted 0 times

...

Rex

4 months ago

I'm not entirely sure, but I remember something about ParentProcessId being crucial in linking events to processes. Maybe it's B?

upvoted 0 times

...

Mindy

4 months ago

I think the answer might be A, since it mentions both ContextProcessId and ParentProcessId, which seems more comprehensive.

upvoted 0 times

...

Tina

4 months ago

I'm a bit confused on this one. I'm not entirely sure how the different process ID fields are used to connect the event to the process. I'll need to review my notes carefully.

upvoted 0 times

...

Arleen

4 months ago

I've seen questions like this before. I think the answer is in option C - the ContextProcessld_decimal field is the one that links the DNSRequest event to the responsible process.

upvoted 0 times

...

Roselle

4 months ago

Okay, let's see. I'm pretty sure it has to do with the process ID fields, but I'm not sure which one is the right one. I'll have to think this through step-by-step.

upvoted 0 times

...

Thurman

4 months ago

Hmm, this one seems a bit tricky. I'll need to carefully review the options and think through the relationship between the DNSRequest event and the process.

upvoted 0 times

...

Cherry

5 months ago

I think the key here is to understand how the DNSRequest event is linked to the responsible process. The question is asking about the specific fields that connect the two.

upvoted 0 times

...