Explain the Technical Capabilities of Falcon Real Time Response CCFR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Where are RTR scripts stored and managed in the Falcon platform?

   • AOn the local file system of each endpoint
   • BIn the Falcon sensor configuration file
   • CIn the CrowdStrike support portal
   • DIn the Scripts library within the Falcon console
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is investigating a Windows host where a known malicious process is running under a specific user account. The analyst needs to terminate the process and then verify it is no longer running. Which RTR commands should the analyst use in sequence?

   • A`kill <pid>` followed by `ps`
   • B`services stop <service_name>` followed by `ps`
   • C`reg delete <pid>` followed by `ps`
   • D`ps` followed by `kill <pid>`
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is responding to a ransomware outbreak that has encrypted files on several Windows workstations. The analyst has confirmed one host is actively beaconing to a known command-and-control server and needs to stop the spread while preserving the ability to continue forensic collection. The analyst has already established an RTR session. Which action should the analyst take first?

   • ARun the `put` command to upload a remediation script.
   • BRun the `kill` command on the suspicious process.
   • CRun the `isolate` command on the affected host.
   • DTerminate the RTR session to cut off the attacker's access.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which RTR feature allows you to block all network traffic to and from a host except for Falcon cloud communications?

   • ARegistry modification
   • BProcess termination
   • CFile quarantine
   • DHost isolation
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is investigating a host that is suspected of being compromised. The analyst wants to ensure that the investigation activities are fully recorded for potential legal action. Which RTR feature should the analyst rely on to meet this requirement?

   • AThe RTR audit log, which records all commands executed during the session.
   • BThe `history` command, which shows commands run in the current session.
   • CThe `get` command, which saves all session output to a file.
   • DThe Windows Event Log on the endpoint, which records RTR activity.
   Reveal Solution Discussion Select an answer first