Exam CCFR-201 topic 1 question 55 discussion

Actual exam question from CrowdStrike's CCFR-201

Question #: 55
Topic #: 1

[All CCFR-201 Questions]

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

A. User logons after the detection
B. Executions of schtasks.exe after the detection
C. Scheduled tasks registered prior to the detection
D. Pivot to a Hash search for taskeng.exe

Show Suggested Answer

Suggested Answer: C 🗳️

by lightmagenta at Dec. 13, 2023, 7:03 a.m.

Comments

Submit Cancel

evilCorpBot7494

4 weeks ago

Selected Answer: C

taskeng.exe is used to run scheduled tasks, so you would need to look for them being registered if they seem malicious. Correct answer is C. The exes used for scheduling tasks are schtasks.exe and at.exe, so that is what you would need to look for.

upvoted 1 times

...

Muffen

8 months, 3 weeks ago

Selected Answer: C

Wildbanana is actually correct this time - On older windows versions any task that runs will spawn a “taskeng.exe” (short for Task Engine) process and the “taskeng.exe” process will spawn the executable(s) requested by the task. So if you was investigating this you woiuld want to look for when the scheduled task was registered.

upvoted 1 times

...

wildbandana

1 year ago

Selected Answer: C

checked in docs

upvoted 1 times

...