Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is reviewing an audit log entry and sees the following fields: `event_type`, `user_id`, `session_id`, `command`, `target_host`, and `timestamp`. The analyst needs to determine whether a file was uploaded or downloaded during the session. Which field should the analyst examine?

   • A`timestamp`
   • B`command`
   • C`target_host`
   • D`user_id`
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) needs to analyze RTR audit logs in a SIEM platform for long-term trend analysis. The SOC wants to ingest the logs automatically. Which method should be used?

   • AAsk the SIEM vendor to pull logs directly from the Falcon database.
   • BManually download the audit logs as CSV files and upload them to the SIEM.
   • CConfigure the Falcon SIEM connector to forward audit logs to the SIEM.
   • DUse the Falcon console to send audit logs via email to the SIEM.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of an RTR-related event type that would be captured in the audit log?

   • AA network firewall rule change
   • BA host's operating system update installation
   • CA user starting an RTR session on a specific host
   • DA user logging into the Falcon console
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is investigating a suspicious RTR session and wants to see the full sequence of commands executed. The analyst has the session ID. What is the most direct way to retrieve the complete command history for that session?

   • ASearch audit logs for the username of the analyst who initiated the session.
   • BReview the host's event log for RTR activity.
   • CFilter audit logs by the session ID and sort by timestamp.
   • DContact the user who ran the session and ask for a transcript.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Falcon admin needs to find all RTR sessions that were started but did not execute any commands. Which audit log event type should the admin filter for to identify these sessions?

   • ACommand executed events
   • BFile operation events
   • CSession end events
   • DSession start events
   Reveal Solution Discussion Select an answer first