A Falcon admin is trying to start an RTR session on a macOS host. The host is online, the sensor is active, and RTR is enabled in the policy. However, the session fails. The admin has the 'Falcon Responder' role. What could be the issue?

The host must be connected to a corporate VPN.

The macOS host requires Full Disk Access to be granted to the sensor.

The admin must use a different role for macOS hosts.

The macOS host does not support RTR at all.

A Falcon admin is setting up RTR for the first time. The admin has assigned the 'Falcon Responder' role to a team member. However, the team member cannot see the RTR option in the console. What is the most likely reason?

The team member's role is not assigned to the correct host group.

The team member is using an unsupported browser.

The team member's user account is not yet activated.

The RTR feature is not enabled in the Falcon tenant.

A responder is managing multiple RTR sessions simultaneously. One session is on a host that is about to be rebooted for maintenance. The responder wants to ensure the session is properly terminated before the reboot. What should the responder do?

Reboot the host and then close the session.

Close the session manually before the reboot.

Use the API to force-terminate the session after the reboot.

Let the session time out naturally.

How can a user initiate a Real Time Response session with a single host from the Falcon console?

Send a command via the 'Command Line' tab in the Falcon console.

Use the 'New Session' button on the dashboard and enter the host's IP address.

Create a new scheduled RTR command and target the host.

Navigate to the host's details page and click 'Real Time Response'.

A responder needs to run a command on a host that is currently offline but is expected to come online within the next hour. The command should run as soon as the host is available. Which method should be used?

Create a batch session with the host as the only target.

Initiate a live session now and wait for the host to connect.

Use the API to initiate a session and set a retry loop.

Schedule an RTR command to run when the host is next online.

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 3

Determine When and How to Connect to a Host CCFR Practice Questions (Page 2)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

19questions here

4free pages

5concepts

Questions 6–10

6application · medium
A Falcon admin is trying to start an RTR session on a macOS host. The host is online, the sensor is active, and RTR is enabled in the policy. However, the session fails. The admin has the 'Falcon Responder' role. What could be the issue?
Select an answer first
7application · medium
A Falcon admin is setting up RTR for the first time. The admin has assigned the 'Falcon Responder' role to a team member. However, the team member cannot see the RTR option in the console. What is the most likely reason?
Select an answer first
8expert · hard
A responder is managing multiple RTR sessions simultaneously. One session is on a host that is about to be rebooted for maintenance. The responder wants to ensure the session is properly terminated before the reboot. What should the responder do?
Select an answer first
9foundation · easy
How can a user initiate a Real Time Response session with a single host from the Falcon console?
Select an answer first
10application · medium
A responder needs to run a command on a host that is currently offline but is expected to come online within the next hour. The command should run as soon as the host is available. Which method should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.