Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can an analyst terminate an active RTR session?

   • ABy uninstalling the Falcon sensor
   • BBy closing the RTR session window in the Falcon console
   • CBy waiting for the session to time out automatically after 5 minutes
   • DBy rebooting the endpoint
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which RTR command would you use to stop a process on an endpoint?

   • Aend
   • Bterminate
   • Ckill
   • Dstop
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of host isolation in RTR?

   • ATo reboot the host to clear memory
   • BTo prevent a compromised host from communicating with other hosts on the network
   • CTo remove malware from the host automatically
   • DTo update the Falcon sensor on the host
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation, an analyst needs to retrieve a specific configuration file from a compromised Linux server to analyze it in a sandbox environment. The analyst has an active RTR session and the file is located at `/etc/application/config.yml`. Which RTR command should the analyst use to accomplish this task?

   • A`ls /etc/application/config.yml`
   • B`get /etc/application/config.yml`
   • C`cat /etc/application/config.yml`
   • D`put /etc/application/config.yml`
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which RTR command would you use to list all running processes on a Windows endpoint?

   • Als
   • Bps
   • Ctasklist
   • Dnetstat
   Reveal Solution Discussion Select an answer first