What type of information is typically found in the 'Host Details' section of a Falcon detection?

The list of all network connections made by the host

The full command-line arguments of the malicious process

The host's operating system, IP address, and recent activity

The list of all files on the host that match known malware signatures

A Falcon alert fires for a suspicious PowerShell command on a workstation. The alert shows the command encoded in Base64. You need to determine the full scope of the activity before containing the host. What should you do first?

Run RTR to terminate the PowerShell process immediately

Disable the host's network adapter via RTR to contain the threat

Quarantine the file from the alert without further analysis

Use the Falcon console to review the detection details and process tree, then pivot to related hosts

After remediating a threat on a Windows host, you need to verify that all persistence mechanisms have been removed. The threat involved a scheduled task, a registry Run key, and a service. Which RTR command sequence should you use to verify?

Use 'netstat' to check for network connections and 'ipconfig' for IP configuration

Use 'reg query' to check the Run key and 'sc query' to check the service, but not the scheduled task

Use 'ps' to list processes and 'ls' to check for the malicious file

Use 'schtasks /query' to check for the task, 'reg query' to check the Run key, and 'sc query' to check the service

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 4

Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 6)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

36questions here

8free pages

10concepts

10 Concepts in This Objective

Threat Investigation Workflow
Falcon Detection and Alert Analysis
Host and Process Context
RTR Command Fundamentals
RTR File System Commands
RTR Process and Service Commands
RTR Registry and Persistence Commands
RTR Network and Artifact Commands
Remediation Strategy and Execution
Verification and Post-Remediation Actions

Questions 26–30

26foundation · easy
What type of information is typically found in the 'Host Details' section of a Falcon detection?
Select an answer first
27application · medium
A Falcon alert fires for a suspicious PowerShell command on a workstation. The alert shows the command encoded in Base64. You need to determine the full scope of the activity before containing the host. What should you do first?
Select an answer first
28expert · hard
After remediating a threat on a Windows host, you need to verify that all persistence mechanisms have been removed. The threat involved a scheduled task, a registry Run key, and a service. Which RTR command sequence should you use to verify?
Select an answer first
29foundation · easy
Which RTR command is used to display a list of running processes on a host?
Select an answer first
30foundation · easy
Which RTR command is used to view the contents of a registry key on a Windows host?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 6)

Questions 26–30

What type of information is typically found in the 'Host Details' section of a Falcon detection?

A Falcon alert fires for a suspicious PowerShell command on a workstation. The alert shows the command encoded in Base64. You need to determine the full scope of the activity before containing the host. What should you do first?

After remediating a threat on a Windows host, you need to verify that all persistence mechanisms have been removed. The threat involved a scheduled task, a registry Run key, and a service. Which RTR command sequence should you use to verify?

Which RTR command is used to display a list of running processes on a host?

Which RTR command is used to view the contents of a registry key on a Windows host?

Keep studying — Real Time Response (RTR)