Worksheets1-2-3 Process Management
Total questions: 75
Worksheet time: 1hrs 15mins
Which process is most suspicious based on ownership and resource behavior?
chrome.exe
winlogon.exe
powershell.exe
explorer.exe
Which statement correctly explains the relationship between file ownership and process ownership?
The user who owns the file always owns the process created from that file.
File ownership changes automatically when a process launches.
A file can be owned by TrustedInstaller, while the running process created from it can be owned by the logged-in user.
Process ownership determines who may modify the executable file on disk.
In Windows, many core executables are owned by TrustedInstaller. What is the primary security purpose of this?
Reduce drive fragmentation.
Prevent users and malware from modifying system-critical executables.
Allow faster process priority switching.
Allow apps to update automatically.
Which term refers to the unique value assigned to every running process so the OS can track and manage it?
SID
PID
GUID
MAC
You are reviewing a process tree and notice: explorer.exe (PID 412) └── powershell.exe (PID 588) └── script.exe (PID 664) Which conclusion is most accurate?
explorer.exe is infected.
script.exe is suspicious and should be investigated because its parent is PowerShell, not a signed Windows process.
The system is normal because PowerShell commonly launches user scripts with no oversight.
The presence of explorer.exe means the system booted clean.
Which Windows tool allows you to see the Parent Process ID (PPID)?
Task Manager alone
File Explorer
PowerShell using wmic or Get-Process
Device Manager
Which description matches a user process?
A process started automatically at startup by Windows.
A process initiated manually by the logged-in user.
A process that cannot be terminated.
A process that always requires administrative privileges.
You see a process in Task Manager with User Name = "xx##spff". What is the correct cybersecurity response?
Ignore it; it’s a background driver.
Immediately kill the process and restart the computer.
Investigate its file location, signature, and parent process.
Reset the user’s password.
Which process launched Chrome?
PID 133
PID 418
PID 2290
Chrome launched itself
What happens if you kill a parent process of multiple child processes?
The children continue unaffected.
Only the parent stops.
All associated child processes terminate.
Windows blocks the termination automatically.
Why is Chrome designed to spawn multiple chrome.exe processes?
To improve performance and stability.
To reduce memory usage.
To simplify debugging.
To prevent the need for a parent process.
Why does Chrome use multiple processes?
To hide malware.
To increase memory storage.
To isolate browser tabs and improve stability.
To make CPU usage appear lower.
A student says: “Killing processes is safe as long as CPU usage is high.” Which correction is most accurate?
CPU usage is irrelevant; only memory matters.
System processes must be researched before termination because killing the wrong one can crash the OS.
Killing any process is reversible.
All processes are safe to stop if they aren’t signed.
The presence of a digital signature on an executable primarily indicates:
The file is always safe.
The file has been scanned by antivirus.
The file’s publisher identity has been verified.
The file uses minimal CPU.
Which is the best strategy to detect malware disguised as a normal process?
Sort Task Manager by name.
Compare running processes against a known “baseline normal.”
Restart the device weekly.
Disable background updates.
Which describes RAM in relation to processes?
Long-term archival storage for inactive software.
Short-term memory used to store active, running processes.
Permanent storage for OS executables.
A protected store used only by BIOS.
Which describes ROM?
Fast, volatile runtime memory.
Storage for processes currently being executed.
Long-term non-volatile storage that holds data not in active use.
Temporary encrypted caching layer.
Which is the most serious sign of malware process behavior?
A process with high CPU usage under Administrator.
A process with SYSTEM ownership performing network activity.
A process that is unsigned but idle.
A process with a normal name and normal CPU usage.
You find a process named svch0st.exe, signed by no publisher, running under StudentUser. Which is the best action?
Immediately terminate it.
Investigate file path, hash, PPID, and persistence before deciding.
Ignore it as it is signed by no publisher.
Restart the system to remove the process.
Which best explains why malware often launches as a child process?
Child processes run faster.
Parent processes hide command-line visibility and permission flow.
Windows always trusts child processes.
PIDs cannot be traced.
Which would most strongly indicate a forged digital signature?
The signature is expired.
The certificate chain does not validate to a trusted authority.
The file version is outdated.
The certificate was issued last week.
What should be checked first before terminating a suspicious process?
Whether it's consuming GPU memory.
Whether it has a command line argument referencing a temp directory.
Whether the process is a system dependency.
Whether the process icon looks normal.
Which best explains why Task Manager alone cannot fully analyze malware?
It cannot detect hidden processes.
It cannot terminate processes.
It cannot display process names.
It cannot monitor CPU usage.
What is the limitation of a tool that does not show PPIDs by default?
It hides all network connections.
It does not show PPIDs by default.
It does not allow process termination.
It cannot view memory.
Place the following steps in the correct order for determining the parent and trace of a process:
Check digital signature and file path → Compare against baseline normal processes → Identify PPID and process tree → Decide whether to terminate.
Identify PPID and process tree → Check digital signature and file path → Compare against baseline normal processes → Decide whether to terminate.
Compare against baseline normal processes → Check digital signature and file path → Identify PPID and process tree → Decide whether to terminate.
Check digital signature and file path → Identify PPID and process tree → Compare against baseline normal processes → Decide whether to terminate.
Which Windows account commonly owns system executables to protect them?
SYSTEM
NT AUTHORITY
TrustedInstaller
Administrator
What happens when explorer.exe is terminated?
The desktop UI disappears.
System reboot.
All network connections are terminated.
The task manager stops functioning.
Which describes a system process?
Must be launched manually.
Runs only in Safe Mode.
Is initiated by the OS to support system operation.
Appears only in Services.msc.
If a user process is running with SYSTEM permissions, what likely happened?
The app is outdated.
A privilege escalation occurred.
The user manually enabled developer mode.
RAM is full.
Why should students learn to recognize normal processes before hunting malware?
Malware is always visible in Task Manager.
Without a baseline, everything looks suspicious or safe arbitrarily.
Malware never mimics real processes.
The OS labels malicious processes in red.
Which best reduces security risk created by unclear file/process ownership?
Network adapter shutdown.
BIOS reset.
explorer.exe is responsible for the desktop shell.
Killing explorer.exe removes icons and taskbar.
Which method can be used to determine where a shortcut’s executable program resides?
Hover the mouse over the icon
Right-click > Properties > Target
Drag the icon to File Explorer
Search Google for the file name
Where are most legitimate application executables (like Chrome or AVG) typically stored?
C:\Windows\System32
C:\Program Files or C:\Program Files (x86)
C:\Users\Public\Desktop
C:\Temp
What does the Digital Signature tab tell you about an executable?
Whether the file is compressed
Whether the publisher’s identity has been verified
Whether the file is encrypted
Whether the file is a shortcut
Why is it important to verify the issuer of a digital certificate?
Because the issuer determines CPU priority
To ensure the application came from a trusted source
To reduce disk usage
To automatically allow updates
If a shortcut points to a file in an unusual location, the correct response is to:
Immediately delete the file
Compare the file path to where legitimate applications are usually stored
End all processes in Task Manager
Restart the operating system
Why does Chrome launch multiple chrome.exe processes?
To hide background activity
To isolate tabs and improve stability
To reduce memory usage
To increase CPU performance
What does PID stand for?
Process Integrity Directory
Process Identifier
Program Initialization Directive
Protected Input Driver
What does PPID represent?
The file’s owner
The parent process that launched another process
The network connection used by a program
The physical device driver used
Which process launched Chrome?
PID 198
PID 620
PID 2400
None—Chrome is standalone
Which tab in Task Manager lets you see who owns a running process?
Performance
Services
Details
Users Only
If the file owner of notepad.exe is TrustedInstaller, but the process owner is your username, what does that mean?
You control the file and process
You own the process, but Windows controls the file on disk
Nobody owns the file
The file cannot run
Which system component is primarily responsible for running the Windows desktop environment?
notepad.exe
explorer.exe
conhost.exe
taskhost.exe
What does explorer.exe handle in Windows?
Network speeds and internet connectivity
Desktop icons, the taskbar, and file navigation
System updates and security patches
CPU usage and memory allocation
What happens when explorer.exe is killed in Windows?
The wallpaper refreshes
The entire desktop interface disappears
Higher network speeds occur
The system shuts down
Why is it important to be cautious when ending processes in Windows?
Any process can restart the computer
Ending certain processes can cause system instability or crash the OS
Ending processes deletes system files
Ending processes slows down updates
What could a sudden unexplained spike in CPU usage indicate?
A normal background update
A process is stuck or something unexpected is running
The graphics card is overheating
The mouse is disconnected
If you see a process with a username that does not match the logged-in user and is unfamiliar, what should you do?
Ignore it
Investigate the file path and digital signature
Restart immediately
Turn off Wi-Fi
Processes that start before a user logs in are most likely:
User processes
System processes
Printer processes
GUI processes
What is the role of RAM in relation to processes?
Long-term storage for logged-off accounts
Temporary storage for active processes and data in use
Permanent file backup
Storage for deleted files
What is the role of CPU in relation to processes?
Stores all inactive processes
Executes instructions performed by running processes
Manages long-term storage
Deletes unused processes
Where did you observe CPU and memory graphs in the lab?
Performance tab in Task Manager
Device Manager
File Explorer
Login screen
What does ending a child process (but not the parent) typically do?
Ends all processes in the system
Stops only the selected child process
Changes file ownership
Crashes the OS
What happens when you end the parent process in a parent-child process structure?
Only the parent closes
The parent and all of its child processes end
Only child processes end
The OS blocks the termination
What Windows command did you use to view PPIDs?
ipconfig
wmic process get name,parentprocessid,processid
ping localhost
dir /P
Why is recognizing normal processes helpful in cybersecurity?
To configure themes
To spot unusual or unauthorized processes
To reduce memory usage
To uninstall unused apps
What is a safe first step when encountering an unknown process?
Kill it immediately
Check who owns it and where it runs from
Rename the file
Run it to see what happens
Why is it important not to assume that every unfamiliar process is malicious?
Windows runs many background processes required for normal operation
Unknown processes are automatically quarantined
Unfamiliar processes are always viruses
Antivirus software handles all processes automatically
Where did you view which user was associated with each running process?
File Explorer
Task Manager → Details tab
Device Manager
Control Panel
If a program is running slowly and using large amounts of RAM, what does this indicate?
The program may simply require a lot of memory to function
The hard drive is unplugged
RAM is corrupted permanently
The monitor is too large
What does it mean when a process shows “Not Responding” in Task Manager?
The computer has crashed
The process has stopped reacting to system input
The process is definitely malicious
The user is logged out
Which conclusion is correct regarding file ownership vs process ownership for the file "notepad.exe"?
StudentUser owns the file and the process.
TrustedInstaller owns the file, but StudentUser owns the running process.
Nobody has permission to run the file.
The file is corrupted.
What is a safe first action if you encounter a process you don't recognize?
End task immediately
Check the file location and digital signature
Delete it from the disk
Restart the computer
If a process is owned by the logged-in user, what does this typically mean?
The user started the program
The operating system is malfunctioning
The program cannot access memory
The program is a system service
Which folder contains many Windows system executables?
C:\Windows\System32
C:\Users\Documents
C:\Downloads
Desktop
Which folder commonly contains legitimate installed application executables?
C:\Program Files\
C:\Temp\
C:\Windows\Fonts\
Recycle Bin
Why did the lab have you open multiple processes (Chrome, Notepad, File Explorer) before opening Task Manager?
To observe how each running application appears as a process
To slow down the computer
To make Task Manager harder to use
To enable Safe Mode
What is the main function of the 'Details' tab in Task Manager?
Manages startup applications
Updates Windows drivers
Displays ownership and status of running processes
Shows network usage statistics
Which action is safest when investigating an unknown process in Windows?
Disable all background services
Check the process's file location and digital signature
Immediately end the process
Delete the process from Task Manager
Which of the following is a sign that a process may be malicious?
The process name matches a common Windows service
The process is using minimal CPU and memory
The process has an unknown publisher and is running from a temporary directory
The process is running from C:\Program Files
What is the safest first step if you suspect a process is malware but are unsure?
Restart the computer in Safe Mode
Immediately terminate the process
Uninstall all recent applications
Research the process name, file path, and digital signature
Which account typically owns critical Windows system files to prevent unauthorized changes?
LocalService
Administrator
Guest
TrustedInstaller
Which action is most effective for identifying an unknown process in Task Manager?
Check the process name only
Sort processes by CPU usage
Review the process’s file location and digital signature
Restart the computer
What is the main risk of running a process with administrative privileges?
It can modify system files and settings
It uses more memory
It cannot access the internet
It runs slower than user processes
Which of the following best describes a parent process?
A process that only runs in Safe Mode
A process that launches or creates another process
A process that is always started by the user
A process that cannot be terminated
