5.3 Apply Roles and Policy Settings, and Track and Review Falcon RTR Audit Logs in Order to Manage User Activity CCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator needs to produce a report of all RTR sessions initiated in the last 30 days, including the user, host, and command executed. The administrator wants to export this data for compliance review. What is the most efficient way to accomplish this?

   • AUse the RTR audit log in the Falcon console, apply filters for the date range, and export the results.
   • BCheck the host management page for each host's RTR history.
   • CReview the Falcon dashboard's activity feed for the last 30 days.
   • DQuery Event Search for all process creation events and manually correlate them with user logins.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a policy that requires all RTR sessions on production hosts to be initiated only by users with a specific role, and all RTR commands must be logged. The company also wants to ensure that RTR is not available on non-production hosts. How should the administrator configure this?

   • ACreate a custom role with RTR permissions and apply it to the production host group.
   • BCreate a host group for production hosts, apply an RTR policy to that group, and assign the specific role to the allowed users.
   • CUse a sensor update policy to enable RTR on production hosts and assign the role to the users.
   • DEnable RTR in the global prevention policy and assign the specific role to all users.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Falcon administrator is reviewing RTR audit logs and discovers that a user with a custom role that includes 'RTR Active Responder' permissions executed a 'rm -rf' command on a Linux host. The role was intended to allow only read-only commands. The administrator needs to prevent this from happening again while minimizing disruption to the user's legitimate duties. What should the administrator do?

   • AModify the custom role to remove the 'rm' command from the allowed list and review the audit logs for other unauthorized commands.
   • BRevoke the user's Falcon access immediately.
   • CDisable RTR for all Linux hosts.
   • DIgnore the incident because the user is trusted.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst suspects that a Falcon user performed an unauthorized RTR command on a critical server last night. The analyst needs to identify the exact command executed and the user account that ran it. Where should the analyst look?

   • AThe Prevention Policy audit log, reviewing policy change history.
   • BThe Host Management page, checking the server's last seen status.
   • CThe Event Search module, querying for process creation events on the server.
   • DThe Real-Time Response audit log, filtering by the server's hostname and the time window.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an audit log review, an administrator notices that a user with a role that only allows read-only RTR commands executed a 'put' command to upload a file to a host. The audit log shows the command was successful. What should the administrator conclude?

   • AThe 'put' command is considered read-only.
   • BThe audit log is not reliable for command-level details.
   • CThe user found a way to bypass the role restrictions.
   • DThe user's role must have been misconfigured or the audit log is inaccurate.
   Reveal Solution Discussion Select an answer first