Determine When and How to Connect to a Host CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A responder is troubleshooting a failed RTR session. The host is online and the sensor is active. The responder has the correct permissions. What should the responder check first?

   • AThe host's firewall settings to ensure outbound connectivity to CrowdStrike cloud.
   • BThe responder's API token expiration.
   • CThe host's operating system version.
   • DThe host's local user account permissions.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A responder needs to run a command on a host that is currently offline. Which RTR method should they use?

   • ABatch session
   • BScheduled RTR command
   • CAPI session
   • DLive session
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization needs to run a script on 200 Windows hosts that are currently online. The script takes about 5 minutes to execute. The responder wants to collect the output from all hosts efficiently. Which approach should be used?

   • ASchedule the script to run on each host at different times to avoid load.
   • BUse the Falcon API to push the script to each host without a session.
   • CInitiate a live session to each host sequentially and run the script.
   • DCreate a batch session that targets all 200 hosts and run the script.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A responder is troubleshooting an RTR session that fails only on hosts in a specific subnet. Other hosts in the same environment work fine. The sensor is active on all hosts. What is the most likely cause?

   • AThe hosts in that subnet are not assigned the correct RTR policy.
   • BThe subnet has a firewall that blocks outbound traffic to CrowdStrike cloud.
   • CThe hosts in that subnet have a different sensor version.
   • DThe hosts in that subnet are running an unsupported operating system.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common fallback action if a live RTR session cannot be established due to network restrictions?

   • AUse the Falcon API to initiate a batch session.
   • BUse a different network path, such as a VPN or proxy, to reach the host.
   • CUse a scheduled RTR command to run at a later time.
   • DWait for the host to come online automatically.
   Reveal Solution Discussion Select an answer first