Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is correlating audit log entries with RTR sessions and finds that a session ID appears in the audit logs, but the session is not listed in the RTR session list. What is the most likely explanation?

   • AThe session was initiated by a different Falcon tenant.
   • BThe session ID was spoofed by an attacker.
   • CThe session was deleted from the session list due to retention policies.
   • DThe audit log entry is corrupted.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which method can be used to export RTR audit log data for external analysis?

   • ARequesting the data from CrowdStrike support via email
   • BUsing the Windows Event Viewer to export the logs
   • CUsing the Falcon console's export feature or API
   • DCopying the audit log entries manually into a spreadsheet
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following RTR activities would be recorded as an audit log event?

   • AA user updating their email address in the Falcon console
   • BA user executing the 'get' command to retrieve a file from an endpoint
   • CA user changing their own Falcon console password
   • DA user creating a new detection rule in the Falcon console
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is required to retain RTR audit logs for 7 years due to regulatory requirements. The Falcon console's default retention is only 90 days. The company has a SIEM with limited storage and cannot store all logs for 7 years. Which approach best balances compliance and storage constraints?

   • ARely on the Falcon console to retain logs for 7 years by upgrading the license.
   • BExport audit logs to a low-cost archival storage solution, such as cold blob storage, and retain them for 7 years.
   • CExport the logs to a compressed CSV file and store it on a local server.
   • DStore the logs in the SIEM for 7 years, even though it will consume significant storage.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is reviewing an audit log entry and sees the field `actor` with the value `user@company.com`. The analyst needs to confirm whether this user is a Falcon admin or a standard user. Which additional field in the audit log entry would provide this information?

   • A`timestamp`
   • B`session_id`
   • C`user_role`
   • D`command`
   Reveal Solution Discussion Select an answer first