Determine When and How to Connect to a Host CCFR Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   What happens to a live RTR session if it remains idle for the session timeout period?

   • AThe session is paused and can be resumed later.
   • BThe session is kept open indefinitely until the user closes it.
   • CThe session is converted to a scheduled command.
   • DThe session is automatically terminated.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A responder attempts to start a live RTR session but receives an error that the host is not available. What is the most likely cause?

   • AThe user does not have the 'Falcon Administrator' role.
   • BThe host is in a different cloud region.
   • CThe host is running an unsupported operating system.
   • DThe host is offline or the Falcon sensor is not communicating.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Falcon admin is trying to start an RTR session on a Linux host. The host is online, the sensor is active, and RTR is enabled. However, the session fails. The admin has the 'Falcon Responder' role. What could be the issue?

   • AThe Linux host does not support RTR.
   • BThe admin must use a different role for Linux hosts.
   • CThe Linux host requires the sensor to be running as root.
   • DThe Linux host's firewall is blocking outbound traffic to CrowdStrike cloud.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A responder has completed a live RTR session on a host. What should the responder do to ensure the session is properly closed?

   • AClose the session using the 'Close Session' option in the console.
   • BReboot the host to terminate the session.
   • CWait for the session to time out automatically.
   • DDelete the host from the Falcon console.
   Reveal Solution Discussion Select an answer first