# CCFR-201 — Question 428

**Type:** multiple_choice
**Topics:** topic_1

## Question

You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

## Correct Answer

_See scenario._

## Explanation

Selected Answer: C
Just checked the fields for event_simpleName=FileOpenInfo and there is no TargetProcessId_decimal. Correct answer is ContextProcessId_decimal. This field is in the output of this event. Also the question says what field do you need from the FileOpenInfo event, so answer has to be ContextProcessId_decimal.

**Reference:** examtopics_top_comment

---
Source: https://hiexam.net/q/crowdstrike/CCFR-201/428  
Practice (tracked): https://hiexam.net/study/CCFR-201/practice