What is the primary purpose of the audit log in the context of Real Time Response (RTR)?

To provide a record of RTR sessions and actions for security review and accountability

To automatically block malicious commands from being executed

To configure which users are allowed to start RTR sessions

To store the actual files collected during RTR sessions

To locate a specific RTR command execution in the audit log, which search technique would be most appropriate?

Search for the Falcon sensor version

Search for the host's IP address only

Search for the command name or a keyword within the event details

Search for the user's role name

An analyst is investigating a possible RTR abuse case. The analyst has a list of audit log entries but needs to determine if any commands were executed outside of normal business hours. The analyst has the timestamps of the entries. Which additional step is necessary to make this determination?

Convert the timestamps to the local timezone of the analyst and compare with business hours.

Review the host's event logs to confirm the commands were executed.

Check the user's role to see if they are allowed to work outside business hours.

Contact the user to ask if they were working outside business hours.

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 7

Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 2)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

24questions here

5free pages

6concepts

Questions 6–10

6foundation · easy
An analyst wants to trace all commands executed during a single RTR session. Which field in the audit log entries would be used to group them together?
Select an answer first
7foundation · easy
What is the primary purpose of the audit log in the context of Real Time Response (RTR)?
Select an answer first
8foundation · easy
To determine which user was responsible for a series of RTR commands, an analyst should correlate the audit log entries by which field?
Select an answer first
9foundation · easy
To locate a specific RTR command execution in the audit log, which search technique would be most appropriate?
Select an answer first
10expert · hard
An analyst is investigating a possible RTR abuse case. The analyst has a list of audit log entries but needs to determine if any commands were executed outside of normal business hours. The analyst has the timestamps of the entries. Which additional step is necessary to make this determination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 2)

Questions 6–10

An analyst wants to trace all commands executed during a single RTR session. Which field in the audit log entries would be used to group them together?

What is the primary purpose of the audit log in the context of Real Time Response (RTR)?

To determine which user was responsible for a series of RTR commands, an analyst should correlate the audit log entries by which field?

To locate a specific RTR command execution in the audit log, which search technique would be most appropriate?

An analyst is investigating a possible RTR abuse case. The analyst has a list of audit log entries but needs to determine if any commands were executed outside of normal business hours. The analyst has the timestamps of the entries. Which additional step is necessary to make this determination?

Keep studying — Real Time Response (RTR)