Identify Administrative Requirements for Real Time Response Settings CCFR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which users are subject to Real Time Response settings in CrowdStrike Falcon?

   • AAll users in the Falcon tenant
   • BOnly users who have been explicitly added to an RTR policy
   • CUsers with roles that include RTR permissions, such as Falcon Responder
   • DOnly users with the Falcon Administrator role
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which setting in Real Time Response policies ensures that all RTR activity is recorded for compliance purposes?

   • AHost group assignment
   • BSession timeout
   • CSensor update policy
   • DAudit logging
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a session parameter that can be configured in a Real Time Response policy?

   • AFirewall rule priority
   • BDetection severity threshold
   • CSensor update frequency
   • DSession timeout duration
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has a mix of Windows and Linux hosts. They want to enable RTR for both platforms but with different session timeout settings: 10 minutes for Windows and 20 minutes for Linux. How should this be configured?

   • ACreate a single RTR policy with a 10-minute timeout and apply it to all hosts.
   • BCreate two RTR policies, one for Windows with a 10-minute timeout and one for Linux with a 20-minute timeout, and assign each to the appropriate host groups.
   • CCreate a single RTR policy with a 20-minute timeout and apply it to all hosts.
   • DConfigure the timeout in the user's profile, not the policy.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In CrowdStrike Falcon, which hosts are subject to a Real Time Response policy?

   • AOnly hosts with the Falcon sensor installed on a Windows operating system
   • BAll hosts in the tenant, regardless of policy assignment
   • COnly hosts that are explicitly assigned to the policy via host groups
   • DOnly hosts that have been manually enabled by an administrator
   Reveal Solution Discussion Select an answer first