Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary benefit of using RTR scripts?

   • AThey automatically remediate all threats without analyst intervention
   • BThey allow you to automate repetitive tasks and execute complex sequences of commands
   • CThey provide a graphical interface for managing endpoints
   • DThey eliminate the need for the Falcon sensor on endpoints
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst has identified a malicious script in a temporary directory on a Linux host. The analyst wants to preserve the file for evidence while also removing it from the active filesystem to prevent further execution. Which RTR command sequence should the analyst use?

   • A`put /tmp/malicious.sh` followed by `rm /tmp/malicious.sh`
   • B`rm /tmp/malicious.sh` followed by `get /tmp/malicious.sh`
   • C`cat /tmp/malicious.sh` followed by `rm /tmp/malicious.sh`
   • D`get /tmp/malicious.sh` followed by `rm /tmp/malicious.sh`
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of Falcon Real Time Response (RTR) in the CrowdStrike Falcon platform?

   • ATo provide a cloud-based interface for executing live commands on endpoints for investigation and remediation
   • BTo manage the configuration of the Falcon sensor across all endpoints in an organization
   • CTo replace the need for endpoint detection and response (EDR) by providing continuous automated patching
   • DTo provide a static analysis sandbox for executing suspicious files in a controlled environment
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst discovers a malicious service on a Windows host that is configured to restart automatically if it is stopped. The analyst needs to stop the service and prevent it from restarting, but the analyst must also preserve the service's registry key for forensic analysis. Which RTR command sequence should the analyst use?

   • A`services stop` the service, then `reg delete` the service key.
   • B`reg query` the service key, then `services stop` the service, then `reg set` the Start value to 4.
   • C`kill` the service process, then `reg set` the Start value to 4.
   • D`reg set` the Start value to 4, then `services stop` the service.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An incident response team needs to collect the same set of forensic artifacts (prefetch files, event logs, and browser history) from 50 endpoints. The team wants to minimize manual effort and ensure consistency across all hosts. Which RTR approach should the team use?

   • AManually run the `get` command on each host for each artifact.
   • BUse the `put` command to upload a collection script to each host and run it locally.
   • CCreate an RTR script that runs the collection commands and execute it against all 50 hosts in parallel.
   • DUse the `cat` command to read the artifacts and copy the output manually.
   Reveal Solution Discussion Select an answer first