Discuss CrowdStrike CCFR-201b Exam Topic 5 Question 12

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

AProcessTimeline Link

BPID

CUTCtime

DProcess ID or Parent Process ID

Suggested Answer: D

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1.The tool requires two parameters:aid(agent ID) andTargetProcessId_decimal(the decimal value of the process ID)1.You can jump to a Process Timeline from many views, such as Hash Search, Host Timeline, Event Search, etc., by clicking on either the Process ID or Parent Process ID fields in those views1.This will automatically populate the aid and TargetProcessId_decimal parameters for the Process Timeline tool1.

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

18 comments · newest first

Gaston 1 month ago

I agree with A, it’s clear and direct.

Miles 1 month ago

True, but I still feel B is relevant.

Berry 2 months ago

But A is the most straightforward option.

Gaston 2 months ago

D) Process ID or Parent Process ID could work too.

Miles 2 months ago

PID is more about identifying processes.

Berry 2 months ago

A makes sense for jumping directly.

Gaston 2 months ago

C) UTCtime seems too specific.

Miles 2 months ago

Really? I thought it was B) PID.

Berry 3 months ago

I think it's A) ProcessTimeline Link.

Joni 3 months ago

Are you sure about that? Sounds a bit off to me.

Delpha 3 months ago

Really? I didn't know you could jump from a Hash Search like that!

Elfriede 3 months ago

No way, it's D) Process ID or Parent Process ID for sure!

Sharee 3 months ago

I thought it was B) PID?

Lavonda 3 months ago

It's definitely A) ProcessTimeline Link.

Blair 4 months ago

I remember we discussed UTCtime in a different context, but I don't think it leads to the Process Timeline. So, I’m not sure about that option.

Armando 4 months ago

I’m leaning towards B) PID, but I can't recall if that directly takes you to the timeline. It’s a bit fuzzy in my mind.

Eleonora 4 months ago

I feel like it could also be D) Process ID or Parent Process ID. We practiced a question similar to this, and it involved navigating through IDs.

Meghann 4 months ago

I think the answer might be A) ProcessTimeline Link, but I'm not entirely sure. I remember something about links in the interface.

CrowdStrike CCFR-201b Exam - Topic 5 Question 12 Discussion