CrowdStrike Exam CCFR-201 Topic 3 Question 27 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 27
Topic #: 3

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

AIt contains the TargetProcessld_decimal value for other related events

BIt contains an internal value not useful for an investigation

CIt contains the ContextProcessld_decimal value for the parent process that made the DNS request

DIt contains the TargetProcessld_decimal value for the process that made the DNS request

Show Suggested Answer

Suggested Answer: D

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1.This field can be used to trace the process lineage and identify malicious or suspicious activities1.For a DNS request event, this field indicates which process made the DNS request1.

by Dominque at Sep 14, 2024, 10:27 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Edelmira

6 months ago

Definitely not B. If it's not useful, why is it there in the first place? Sounds like someone was just lazy in their field naming conventions. *rolls eyes*

upvoted 0 times

Margurite

5 months ago

I agree, it does seem strange to have a field that's not useful. Maybe there's a reason we're not seeing.

upvoted 0 times

...

Margarita

5 months ago

C) It contains the ContextProcessld_decimal value for the parent process that made the DNS request

upvoted 0 times

...

Alease

5 months ago

A) It contains the TargetProcessld_decimal value for other related events

upvoted 0 times

...

Richelle

6 months ago

Hmm, I'm torn between A and C. I feel like it could go either way, but C seems a bit more logical. Although, who knows what kind of bizarre logic these security tools use. *shrugs*

upvoted 0 times

Bok

5 months ago

Yeah, these security tools can be a bit confusing sometimes.

upvoted 0 times

...

Shaun

5 months ago

I agree, C seems like the most logical choice here.

upvoted 0 times

...

Kara

6 months ago

I think it's C, it makes sense to have the parent process value.

upvoted 0 times

...

Viola

6 months ago

B has to be the right answer. An 'internal value not useful for an investigation' sounds like the kind of cryptic field that security tools love to include. #JustSecurityThings

upvoted 0 times

...

Anna

6 months ago

I'm going with D. The TargetProcessld_decimal value for the process that made the DNS request seems like the most relevant information to have in this field.

upvoted 0 times

Wayne

5 months ago

I'm sticking with D, the TargetProcessld_decimal value for the process that made the DNS request seems crucial.

upvoted 0 times

...

Katy

5 months ago

I'm not sure, but A also sounds plausible. It could contain the TargetProcessld_decimal value for other related events.

upvoted 0 times

...

Mariko

5 months ago

I agree with you, C makes more sense in this context.

upvoted 0 times

...

Ellsworth

6 months ago

I think it's C. The ContextProcessld_decimal value for the parent process that made the DNS request would be more useful.

upvoted 0 times

...

Broderick

6 months ago

I'm not sure, but I think it might be related to the TargetProcessId_decimal value for other related events.

upvoted 0 times

...

Curtis

7 months ago

I agree with Laurel. It makes sense that it would link back to the parent process.

upvoted 0 times

...

Laurel

7 months ago

I think the purpose of the ContextProcessId_decimal field is to contain the ContextProcessId_decimal value for the parent process that made the DNS request.

upvoted 0 times

...

Verona

7 months ago

I think it's C. The ContextProcessld_decimal field should contain the parent process that made the DNS request, not the target process. That makes the most sense in the context of a DNS event.

upvoted 0 times

Felice

5 months ago

Exactly. It's a key piece of information for investigating DNS events.

upvoted 0 times

...

Marcos

5 months ago

So, the ContextProcessld_decimal value helps us trace back to the parent process for more context.

upvoted 0 times

...

Rodney

5 months ago

Yes, I agree. It's important to understand the relationship between processes in a DNS request event.

upvoted 0 times

...

Bettye

6 months ago

I think it's C. The ContextProcessld_decimal field should contain the parent process that made the DNS request, not the target process. That makes the most sense in the context of a DNS event.

upvoted 0 times

...