Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What does the RTR command 'cat' do when used on a file?

   • AIt displays the contents of the file
   • BIt creates a new file
   • CIt deletes the file
   • DIt changes the permissions of the file
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   You are investigating a Falcon detection on a Windows host. The alert indicates a suspicious process running from a temp directory. You need to gather more context about the process and its parent before deciding on remediation. Which RTR command sequence should you use?

   • AUse 'kill' on the process, then 'ls' the temp directory
   • BUse 'process list' to view processes, then 'filetree' to inspect the temp directory
   • CUse 'ps' to list processes, then 'cat' the process's executable path
   • DUse 'registry' to check for persistence, then 'netstat' for connections
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are responding to a Falcon detection on a critical database server. The threat involves a malicious process and a scheduled task that recreates the process if it is killed. You need to remediate the threat without disrupting the database service. Which RTR command sequence should you use?

   • AKill the process first, then delete the scheduled task
   • BKill the process and then run a full antivirus scan
   • CDisable the scheduled task, then reboot the server
   • DDelete the scheduled task first, then kill the process, and verify the process does not restart
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Falcon detection on a Windows host shows a malicious service running under the SYSTEM account. The service has dependencies on other legitimate services. You need to stop the malicious service without affecting the legitimate services. Which RTR command should you use?

   • Anet stop MaliciousService /y
   • Bsc stop MaliciousService
   • Ctaskkill /f /im MaliciousService.exe
   • Dwmic service where name='MaliciousService' call stopservice
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are remediating a threat on a Windows host. The threat involves a malicious process, a scheduled task, and a file in the startup folder. You need to ensure all persistence mechanisms are removed. Which RTR command sequence should you use?

   • Akill <PID> && schtasks /delete /tn "TaskName" /f && rm C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.exe
   • Bschtasks /delete /tn "TaskName" /f && kill <PID>
   • Ckill <PID> && rm C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.exe
   • Drm C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.exe && schtasks /delete /tn "TaskName" /f
   Reveal Solution Discussion Select an answer first