Which tool can be used to get further details on orphaned processes in a user session?

Which tool can be used to get further details on orphaned processes in a user session?

• A. Procmon
• B. Process Explorer
• C. Regmon
• D. Handle

Answer: (B)

Understanding how process relationships are shown in Windows is what this question tests. To diagnose orphaned processes in a user session, you need a tool that reveals the parent-child relationships of running processes in real time. Process Explorer provides a clear, live Process Tree that lets you see who started each process and how it’s connected within the session. By inspecting a process’s properties, you can confirm its parent and determine whether that parent still exists in the same user session. This makes it easy to spot orphaned processes and decide on the appropriate action, such as investigation or termination to reclaim resources in a Citrix session. Procmon tracks detailed file, registry, and process activity, but it isn’t focused on the hierarchical relationships between processes. Regmon monitors registry activity, not process ancestry. Handle lists open handles but also doesn’t illuminate parent-child relationships. Process Explorer's emphasis on the process tree and per-process details is what makes it the best fit for identifying orphaned processes in a user session.

Understanding how process relationships are shown in Windows is what this question tests. To diagnose orphaned processes in a user session, you need a tool that reveals the parent-child relationships of running processes in real time. Process Explorer provides a clear, live Process Tree that lets you see who started each process and how it’s connected within the session. By inspecting a process’s properties, you can confirm its parent and determine whether that parent still exists in the same user session. This makes it easy to spot orphaned processes and decide on the appropriate action, such as investigation or termination to reclaim resources in a Citrix session.

Procmon tracks detailed file, registry, and process activity, but it isn’t focused on the hierarchical relationships between processes. Regmon monitors registry activity, not process ancestry. Handle lists open handles but also doesn’t illuminate parent-child relationships. Process Explorer's emphasis on the process tree and per-process details is what makes it the best fit for identifying orphaned processes in a user session.