ExamTopics Logo
Mail Us[email protected]
Menu
Crowdstrike Discussions
exam questions

Exam CCFR-201 All Questions

View all questions & answers for the CCFR-201 exam
Go to Exam

Exam CCFR-201 topic 1 question 55 discussion

Actual exam question from CrowdStrike's CCFR-201
Question #: 55
Topic #: 1
[All CCFR-201 Questions]

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

  • A. User logons after the detection
  • B. Executions of schtasks.exe after the detection
  • C. Scheduled tasks registered prior to the detection
  • D. Pivot to a Hash search for taskeng.exe
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by lightmagenta at Dec. 13, 2023, 7:03 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Muffen
6 months, 2 weeks ago
Selected Answer: C
Wildbanana is actually correct this time - On older windows versions any task that runs will spawn a “taskeng.exe” (short for Task Engine) process and the “taskeng.exe” process will spawn the executable(s) requested by the task. So if you was investigating this you woiuld want to look for when the scheduled task was registered.
upvoted 1 times
...
wildbandana
10 months, 3 weeks ago
Selected Answer: C
checked in docs
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago