Identify Administrative Requirements for Real Time Response Settings CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a compliance-related setting that governs Real Time Response activity in CrowdStrike Falcon?

   • ASetting the sensor update channel
   • BAssigning hosts to a dynamic group
   • CRequiring a reason for RTR session initiation
   • DConfiguring the prevention level
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which CrowdStrike role is required to enable Real Time Response (RTR) for a Falcon tenant?

   • AFalcon Administrator
   • BFalcon Responder
   • CFalcon Reader
   • DFalcon Malware Query
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security analyst needs to be able to run Real Time Response commands on hosts, but should NOT be able to modify RTR policies. Which CrowdStrike role should be assigned?

   • AFalcon Responder
   • BFalcon Malware Query
   • CFalcon Administrator
   • DFalcon Reader
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon administrator creates an RTR policy and assigns it to a host group named 'Windows Servers'. The policy is enabled. A Windows server in that group is not responding to RTR commands. The server is online and the sensor is active. Which step should the administrator take first to troubleshoot the issue?

   • ACheck that the sensor is running the latest version.
   • BConfirm that the user has the Falcon Responder role.
   • CReboot the host to re-establish the sensor connection.
   • DVerify that the host is actually a member of the 'Windows Servers' host group.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A compliance officer requires that all Real Time Response (RTR) sessions be logged with details of who ran which command on which host. The administrator needs to ensure this is enabled. Which setting should be verified?

   • AThe Falcon console's 'Activity Log' is set to retain data for 90 days.
   • BThe 'Command history' is exported to a SIEM.
   • CThe 'Session recording' feature is turned on for each user.
   • DAudit logging for RTR activity is enabled in the RTR policy.
   Reveal Solution Discussion Select an answer first