• I've read the intro and deployed the attached virtual machine. 

No Answer

• On to the next task... 

No Answer

• What PID should System always be? 

 Answer : 4

• What other two processes does smss.exe start in Session 1? (answer format: process1, process2) 

Answer : csrss.exe, winlogon.exe

• What was the process which had PID 384 and PID 488? 

Answer : smss.exe

• Which process you might not see running if Credential Guard is not enabled? 

Answer : lsaiso.exe

•  How many instances of services.exe should be running on a Windows system? 

  Answer : 1

• What single letter parameter should always be visible in the Command line or Binary path? 

Answer : k

• What is the parent process for LSASS?

Answer : wininit.exe

• What is the non-existent parent process for winlogon.exe? 

Answer : smss.exe

• What is the non-existent process for explorer.exe? 

Answer : userinit.exe