Cert Master

KT-EPS Process analysis

Task Manager shows a browser consuming CPU but Process Explorer shows no matching process. Likely explanation?

Multiple choice — select one answer

Answer choices

  1. a. User imagination, without security or identity team coordination per policy.
  2. b. Normal GPU acceleration, without security or identity team coordination per policy.
  3. c. Process hollowing or rootkit-style hiding—use EDR kernel telemetry
  4. d. Patch Tuesday side effect only, without security or identity team coordination per policy.

Architectural breakdown & explanation

Discrepancies suggest advanced evasion; EDR kernel view is needed.

Correct answer(s): c. Process hollowing or rootkit-style hiding—use EDR kernel telemetry

Exam domain: Process analysis (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Endpoint Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications