CrowdStrike Certified Falcon Responder (CCFR) — Question 7

How does a DNSRequest event link to its responsible process?

Answer options

• A. Via both its ContextProcessId_decimal and ParentProcessId_decimal fields
• B. Via its ParentProcessId_decimal field
• C. Via its ContextProcessId_decimal field
• D. Via its TargetProcessId_decimal field

Correct answer: C

Explanation

The correct answer is C because the ContextProcessId_decimal field specifically identifies the process associated with the DNSRequest event. While the ParentProcessId_decimal and TargetProcessId_decimal fields may provide additional context, they do not directly link to the responsible process for the DNSRequest.