Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the first step in developing a remediation plan using RTR commands?

   • AContain the host by disabling its network access
   • BDelete all files associated with the threat
   • CTerminate all suspicious processes immediately
   • DIdentify the scope of the threat, including affected hosts and indicators of compromise
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of the RTR command 'reg delete'?

   • ATo view the contents of a registry key
   • BTo add a new registry key
   • CTo change the permissions of a registry key
   • DTo remove a registry key or value
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which RTR command is used to list the contents of a directory on a compromised host?

   • Acd
   • Bcat
   • Cls
   • Dpwd
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the first step in the systematic threat investigation workflow within Falcon, from initial alert to containment?

   • AReview and triage the detection to confirm it is a true positive and understand its scope
   • BContain the host immediately to prevent further spread
   • CRun a full system scan with RTR commands to identify all malicious files
   • DQuarantine all files associated with the alert
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Falcon detection on a host shows a process making connections to a known malicious IP. You need to collect evidence of the network connections and any associated artifacts for further analysis. Which RTR command should you use?

   • Anetstat -ano
   • Barp -a
   • Cping <malicious-IP>
   • Dipconfig /all
   Reveal Solution Discussion Select an answer first