Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After remediating a threat on a Windows host, you need to verify that the malicious process is no longer running and the associated file has been removed. Which RTR command sequence should you use?

   • Areg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
   • Bkill <PID> && rm C:\path\to\malware.exe
   • Cps && ls C:\path\to\malware.exe
   • Dnetstat -ano && ipconfig /all
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of the 'Detection Summary' in a Falcon alert?

   • ATo show the full command-line arguments of the malicious process
   • BTo list all files that have been quarantined by Falcon
   • CTo provide a detailed list of all network connections made by the host
   • DTo give a concise overview of the detection, including the technique used and the host affected
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which RTR command is used to display active network connections on a host?

   • Als
   • Bps
   • Cnetstat
   • Dcat
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Falcon detection on a Windows server shows a suspicious service named 'UpdateSvc' running. You need to stop the service and prevent it from starting again. Which RTR command should you use?

   • Awmic service where name='UpdateSvc' call stopservice
   • Btaskkill /im UpdateSvc.exe /f
   • Csc stop UpdateSvc && sc config UpdateSvc start= disabled
   • Dnet stop UpdateSvc && net start UpdateSvc
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Falcon detection on a domain controller shows a suspicious PowerShell script that has created a local admin account. The alert indicates the script was launched from a Word document opened by a user. You need to contain the threat, remove the account, and verify the system is clean. However, the domain controller is critical and cannot be rebooted during business hours. What should you do?

   • AReboot the domain controller to clear the malicious process, then delete the account
   • BUse RTR to kill the PowerShell process and then run a full antivirus scan
   • CImmediately isolate the host, use RTR to delete the local admin account, and then verify no other persistence mechanisms exist
   • DDelete the Word document and the PowerShell script, then verify the account is still present
   Reveal Solution Discussion Select an answer first