Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of the 'put' command in RTR?

   • ATo download a file from the endpoint to the analyst's machine
   • BTo upload a file from the analyst's machine to the endpoint
   • CTo list files in a directory
   • DTo delete a file from the endpoint
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which RTR command would you use to display the contents of a text file on a Windows endpoint?

   • Acp
   • Bls
   • Ccat
   • Drm
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which RTR command would you use to create a new empty file on an endpoint?

   • Apwd
   • Bmkdir
   • Cgrep
   • Dtouch
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst needs to check if a Windows host has a specific autorun entry that points to a suspicious executable. The analyst wants to see the value data without modifying anything. Which RTR command should the analyst use?

   • A`reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"`
   • B`reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -v <value_name>`
   • C`reg set "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" <value_name> <data>`
   • D`ls "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"`
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the first step to initiate an RTR session on an endpoint from the Falcon console?

   • ADownload the Falcon sensor installer to the endpoint
   • BConfigure a new prevention policy for the endpoint
   • CSelect the endpoint and choose 'Real Time Response' from the actions menu
   • DCreate a new RTR script in the Scripts library
   Reveal Solution Discussion Select an answer first