Cert Master

KT-EPS Process analysis

An analyst sees powershell.exe spawning rundll32 with no window. What should they collect FIRST?

Multiple choice — select one answer

Answer choices

  1. a. Printer queue status, without security or identity team coordination per policy.
  2. b. Parent/child process tree, command line, and hash of loaded DLL
  3. c. User's last vacation dates, without security or identity team coordination per policy.
  4. d. Only CPU fan speed, without security or identity team coordination per policy.

Architectural breakdown & explanation

Process lineage and command lines are core to endpoint investigation.

Correct answer(s): b. Parent/child process tree, command line, and hash of loaded DLL

Exam domain: Process analysis (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications