What is the primary purpose of Real Time Response (RTR) commands in Falcon?

To manage the Falcon sensor configuration on multiple hosts

To provide a real-time shell for executing commands on a host to investigate and remediate threats

To generate compliance reports for the organization

To automate the creation of Falcon detection rules

A Falcon detection on a Linux host shows a suspicious script in /var/tmp. You need to determine if the script is actively running and what it has been doing. The host is running a production application that cannot be stopped. Which RTR command sequence should you use?

Use 'ps' to check for the script process, then 'cat' the script to review its contents

Use 'netstat' to check for network connections and 'journalctl' to view logs

Use 'ls' to list the script and 'stat' to view its metadata

Use 'rm' to delete the script and 'kill' to terminate any related processes

Which of the following is a common use case for RTR commands in threat remediation?

Changing the host's firewall rules

Deleting malicious files from the host

Creating new user accounts on the host

Updating the host's operating system

A Falcon detection on a server shows a process spawning cmd.exe with network connections to an external IP. You need to determine if the activity is malicious and what data may have been exfiltrated. Which combination of Falcon features should you use?

Immediately run RTR to kill the process and delete the associated files

Use the Falcon console to search for the external IP in threat intelligence only

Review the detection's process tree and use RTR to collect network connections and recent file activity

Run a full antivirus scan on the server using RTR

A Falcon detection on a Linux host shows a malicious script running from /tmp. You need to remediate the threat by stopping the process and removing the script. Which RTR command sequence should you use?

Use 'reboot' to restart the host, then 'ls' to check the script

Use 'ls' to list the script, then 'cat' to view its contents

Use 'put' to upload a clean script, then 'run' to execute it

Use 'kill' to terminate the process, then 'rm' to delete the script

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 4

Investigate a Threat Within Falcon and Use RTR Commands to Remediate It CCFR Practice Questions (Page 7)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

36questions here

8free pages

10concepts

10 Concepts in This Objective

Threat Investigation Workflow
Falcon Detection and Alert Analysis
Host and Process Context
RTR Command Fundamentals
RTR File System Commands
RTR Process and Service Commands
RTR Registry and Persistence Commands
RTR Network and Artifact Commands
Remediation Strategy and Execution
Verification and Post-Remediation Actions

Questions 31–35

31foundation · easy
What is the primary purpose of Real Time Response (RTR) commands in Falcon?
Select an answer first
32expert · hard
A Falcon detection on a Linux host shows a suspicious script in /var/tmp. You need to determine if the script is actively running and what it has been doing. The host is running a production application that cannot be stopped. Which RTR command sequence should you use?
Select an answer first
33foundation · easy
Which of the following is a common use case for RTR commands in threat remediation?
Select an answer first
34application · medium
A Falcon detection on a server shows a process spawning cmd.exe with network connections to an external IP. You need to determine if the activity is malicious and what data may have been exfiltrated. Which combination of Falcon features should you use?
Select an answer first
35application · medium
A Falcon detection on a Linux host shows a malicious script running from /tmp. You need to remediate the threat by stopping the process and removing the script. Which RTR command sequence should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.