Examice

Exam GCIH All QuestionsBrowse all questions from this exam

Go to Exam

Question 101

Which of the following statements describes the data below from volatility's pstree plugin?

Cmd.exe was the child process of OneDrive.exe

Chrmstp.exe was launched by MSASCuiL.exe

Explorer.exe was the parent process for firefox.exe

Notepad.exe was launched with Administrative privileges

Correct Answer: C

The data shows that explorer.exe (PID 3428) has multiple child processes, indicated by the processes that share the same PPID of 3428. Firefox.exe (PID 4924) and notepad.exe (PID 4300) are shown as children of explorer.exe (PPID 3428). Therefore, it's clear that explorer.exe was the parent process for firefox.exe.

Discussion

ImaflowerOption: C

PPID and indentation

Imaflower

Based on the PPID, the answer is inaccurate?