Identify Administrative Requirements for Real Time Response Settings CCFR Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   In the CrowdStrike Falcon console, where would an administrator go to enable Real Time Response and configure session parameters such as session timeout?

   • ADetection Policies
   • BHost Setup and Management
   • CReal Time Response Policies
   • DPrevention Policies
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A new administrator is tasked with enabling Real Time Response (RTR) for the organization. They have the Falcon Administrator role. They create an RTR policy and enable it. However, they notice that the policy is not applied to any hosts. What is the most likely reason?

   • AThe sensor version on the hosts is too old.
   • BThe administrator does not have the Falcon Responder role.
   • CThe policy was not assigned to any host groups.
   • DThe RTR policy is disabled by default.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to allow Real Time Response (RTR) sessions to run for a maximum of 30 minutes, after which the session is automatically terminated even if the user is active. Which RTR policy setting should be configured?

   • ASet the 'Session approval' to require re-approval every 30 minutes.
   • BSet the 'Command timeout' to 30 minutes.
   • CSet the 'Session timeout' to 30 minutes.
   • DSet the 'Maximum session duration' to 30 minutes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization has a host group 'Finance' that contains sensitive financial systems. They want to ensure that any RTR session on these hosts is logged and that the session requires a second person to approve before it starts. Which configuration should be used?

   • AAssign the Falcon Administrator role to the Finance team and rely on them to log sessions manually.
   • BCreate an RTR policy with audit logging enabled and session approval required, then assign it to the 'Finance' group.
   • CEnable audit logging globally and require session approval for all users.
   • DUse the default RTR policy and enable session approval in the user's profile.
   Reveal Solution Discussion Select an answer first