Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Where can an analyst review a log of RTR commands executed on endpoints?

   • AIn the CrowdStrike community forum
   • BIn the Falcon sensor configuration file
   • CIn the Windows Event Viewer on the endpoint
   • DIn the Falcon console's audit log or activity log
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is investigating a Linux host and needs to collect the contents of the `/var/log/auth.log` file for analysis. The analyst has an active RTR session. Which command should the analyst use to retrieve this file?

   • A`ls /var/log/auth.log`
   • B`cat /var/log/auth.log`
   • C`get /var/log/auth.log`
   • D`put /var/log/auth.log`
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a category of RTR commands used for host investigation?

   • ANetwork configuration commands
   • BFile system commands
   • CCloud management commands
   • DUser authentication commands
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which RTR command category would you use to stop a malicious process on an endpoint?

   • AProcess and service management
   • BFile operations
   • CRegistry operations
   • DData collection
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst needs to determine which processes are running on a Windows host and identify any that have a suspicious parent-child relationship. Which RTR command should the analyst run first?

   • A`reg query`
   • B`ps`
   • C`services list`
   • D`ls`
   Reveal Solution Discussion Select an answer first