Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In Falcon, what does the 'Process Tree' view provide for a given detection?

   • AA hierarchical view of the processes involved, showing parent-child relationships
   • BA list of all network connections made by the host
   • CA timeline of file system events on the host
   • DA list of all users who have logged into the host
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of the RTR command 'get'?

   • ATo list the contents of a directory
   • BTo download a file from the host to the Falcon console
   • CTo terminate a process
   • DTo upload a file to the host
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are investigating a Falcon detection that shows a malicious DLL being loaded via a registry Run key. You need to remove the registry entry and verify the DLL file is deleted. Which RTR command sequence should you use?

   • Areg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Malware /f && rm C:\path\to\malware.dll
   • Brm C:\path\to\malware.dll && reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
   • Creg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Malware /t REG_SZ /d "" /f
   • Dreg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" && ls C:\path\to\malware.dll
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When analyzing a Falcon detection, what does the 'Pattern of Activity' section primarily help you understand?

   • AThe list of all files on the host that match known malware signatures
   • BThe list of all users who have logged into the host
   • CThe sequence of events that led to the detection, including related processes and files
   • DThe network connections made by the host in the last 24 hours
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the Falcon threat investigation workflow, what is the purpose of the containment step?

   • ATo collect forensic evidence from the host for legal proceedings
   • BTo permanently delete all malicious files from the host
   • CTo restore the host to its original configuration
   • DTo isolate the affected host to prevent the threat from spreading to other systems
   Reveal Solution Discussion Select an answer first