5.3 Apply Roles and Policy Settings, and Track and Review Falcon RTR Audit Logs in Order to Manage User Activity CCFA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security auditor requests a list of all RTR sessions that occurred in the last quarter, including the user, host, and commands executed. The Falcon console's RTR audit log only retains data for 90 days. The administrator needs to provide the data for the full quarter. What should the administrator do?

   • AIncrease the audit log retention period in the Falcon console settings.
   • BExport the RTR audit log data to an external SIEM or storage solution for long-term retention.
   • CRequest the data from CrowdStrike support.
   • DUse Event Search to reconstruct RTR sessions from process events.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a mix of Windows and Linux hosts. They want to enable RTR for all hosts but restrict RTR commands on Linux hosts to a specific set of read-only commands. How should the administrator configure this?

   • ADisable RTR on Linux hosts and only enable it on Windows hosts.
   • BEnable RTR in a single policy applied to all hosts and rely on user training to avoid destructive commands on Linux.
   • CCreate separate RTR policies for Windows and Linux host groups, with the Linux policy allowing only the approved read-only commands.
   • DCreate a custom role for Linux administrators that only allows read-only commands, and assign it to all users.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Falcon feature provides a chronological record of real-time response commands executed by users?

   • AHost management
   • BRTR audit log
   • CEvent search
   • DFalcon Fusion workflows
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a routine review of RTR audit logs, an administrator notices that a user with a standard analyst role executed a 'reg delete' command on a production host. The user's role does not include registry modification permissions. What should the administrator do first?

   • AImmediately revoke the user's Falcon account access.
   • BIgnore the event because the user is a trusted analyst.
   • CDisable RTR for the production host group.
   • DVerify the audit log entry to confirm the command and the user, then investigate how the user obtained the permission.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An administrator is investigating a potential security incident and needs to determine if any RTR commands were executed on a compromised host before the host was isolated. The administrator has the host's hostname and a time range. What is the most reliable way to gather this information?

   • AUse Event Search to look for process execution events on the host.
   • BReview the Falcon dashboard's activity feed for the host.
   • CQuery the RTR audit log for the hostname and time range to see all RTR commands executed.
   • DCheck the host's local event logs by initiating a new RTR session.
   Reveal Solution Discussion Select an answer first