Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the scope of Falcon Real Time Response?

   • AIt provides a command-line interface to interact with endpoints in real time for investigation and remediation
   • BIt is a scheduled scanning tool that runs vulnerability assessments on endpoints
   • CIt is limited to read-only commands and cannot modify endpoint state
   • DIt operates only on endpoints that are connected to the corporate network via VPN
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is it important to audit RTR actions?

   • ATo automatically remediate threats
   • BTo ensure accountability and provide a record for compliance and forensic investigations
   • CTo improve the performance of the Falcon sensor
   • DTo reduce the number of RTR sessions needed
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which RTR command is used to collect a file from an endpoint and store it in the Falcon cloud?

   • Acp
   • Bput
   • Ccollect
   • Dget
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which RTR command is used to query a Windows registry key?

   • Areg query
   • Breg delete
   • Creg add
   • Dreg edit
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a host where a malware variant modifies a specific registry value every time the system boots. The analyst needs to capture the value before it is modified again, but the system is scheduled to reboot in 10 minutes. The analyst has an active RTR session. Which action should the analyst take first?

   • AUse `reg query` to read the current value and document it.
   • BUse `get` to retrieve the registry hive file.
   • CUse `reg set` to change the value to a benign state.
   • DUse `services stop` to halt the malware service.
   Reveal Solution Discussion Select an answer first