What is a common post-remediation action to ensure the host is secure?

Delete all user accounts on the host

Run a full scan with Falcon to confirm no threats remain

Disable the host's network access permanently

Reboot the host to clear any remaining malicious processes

A Falcon alert on a web server shows a process making outbound connections to a known C2 domain. The process is a legitimate-looking service binary. You need to determine if the binary is malicious or if it has been tampered with, and you must preserve evidence for potential legal action. Which approach should you take?

Run a memory dump and then reboot the server

Use RTR to collect the binary's hash, compare it to known-good values, and collect network connection logs

Disable the service and monitor for further connections

Immediately delete the binary and terminate the process

After executing a remediation plan, what is the purpose of verification?

To identify new threats that may have appeared

To document the remediation steps for legal purposes

To confirm that the threat has been removed and the host is clean

To update the Falcon sensor to the latest version

A Falcon detection on a Windows host shows a process running from a user's AppData folder. The process has a valid digital signature from a known software vendor. You need to determine if this is a false positive or a legitimate threat. Which RTR command sequence should you use?

Use 'kill' to terminate the process and 'rm' to delete the file

Use 'ps' to view the process command line, then 'cat' the executable's file metadata

Use 'reg query' to check for persistence and 'schtasks' to list scheduled tasks

Use 'netstat' to check for network connections and 'ipconfig' for IP configuration

What is the purpose of the RTR command 'kill'?

To change the priority of a process

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 4

Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 1)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

36questions here

8free pages

10concepts

10 Concepts in This Objective

Threat Investigation Workflow
Falcon Detection and Alert Analysis
Host and Process Context
RTR Command Fundamentals
RTR File System Commands
RTR Process and Service Commands
RTR Registry and Persistence Commands
RTR Network and Artifact Commands
Remediation Strategy and Execution
Verification and Post-Remediation Actions

Questions 1–5

1foundation · easy
What is a common post-remediation action to ensure the host is secure?
Select an answer first
2expert · hard
A Falcon alert on a web server shows a process making outbound connections to a known C2 domain. The process is a legitimate-looking service binary. You need to determine if the binary is malicious or if it has been tampered with, and you must preserve evidence for potential legal action. Which approach should you take?
Select an answer first
3foundation · easy
After executing a remediation plan, what is the purpose of verification?
Select an answer first
4expert · hard
A Falcon detection on a Windows host shows a process running from a user's AppData folder. The process has a valid digital signature from a known software vendor. You need to determine if this is a false positive or a legitimate threat. Which RTR command sequence should you use?
Select an answer first
5foundation · easy
What is the purpose of the RTR command 'kill'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.