Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization needs to preserve RTR audit log data for a compliance review. What is the recommended way to retain this data?

   • ATake screenshots of the audit log pages
   • BRely on the Falcon console's default retention period
   • CPrint the audit log entries and store them in a file cabinet
   • DExport the audit log data to an external storage system
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing an audit log entry and sees the field `operation` with the value `read`. The analyst needs to know which file was read. Which field in the audit log entry should the analyst look at?

   • A`user_id`
   • B`target_file`
   • C`timestamp`
   • D`session_id`
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon administrator needs to find all RTR sessions where a specific user ran the `cat` command on a Linux host. The admin knows the username but not the exact time. Which approach will most efficiently locate these events in the audit logs?

   • AFilter audit logs by event type 'RTR command executed' and then search for the username and command string.
   • BExport all audit logs to a CSV file and use a spreadsheet to manually search for the username.
   • CSearch audit logs for the hostname of the Linux machine, then review all events from that host.
   • DUse the RTR session list to find sessions initiated by the user, then open each session's transcript.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is correlating audit log entries with RTR sessions and notices that a single session ID appears in multiple entries with different timestamps. What does this indicate?

   • AThe session had multiple commands executed over time.
   • BThe session was terminated and restarted.
   • CThe session was hijacked by another user.
   • DThe audit log is corrupted.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's compliance team requires a monthly export of all RTR audit logs for external review. The team wants to automate this process to avoid manual exports. Which approach should the Falcon admin take?

   • AAsk the compliance team to access the Falcon console directly and view the logs.
   • BConfigure the Falcon console to email the logs to the compliance team automatically.
   • CManually export the logs each month and save them to a shared drive.
   • DUse the Falcon API to programmatically export audit logs on a schedule.
   Reveal Solution Discussion Select an answer first