Review Audit Logs to Audit RTR Activity CCFR Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   When reading an audit log entry for an RTR file operation, which field would show the path of the file that was accessed?

   • ACommand line
   • BHost name
   • CSession ID
   • DFile path or target path
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is reviewing an audit log entry and sees the field `result` with the value `success`. However, the analyst suspects that the command actually failed because the target file did not exist. What should the analyst do to confirm?

   • AAssume the command succeeded because the result field says so.
   • BCheck the `error` field in the audit log entry for any error messages.
   • CIgnore the discrepancy because the audit log is always correct.
   • DRe-run the command to see if it fails.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is required to retain RTR audit logs for 18 months to meet a compliance mandate. The audit logs are currently stored in the Falcon console with a default retention period. What should the team do to meet the requirement?

   • AExport the audit logs to an external SIEM or storage solution with the required retention.
   • BTake screenshots of the audit log entries and store them in a shared folder.
   • CCreate a scheduled task to re-run the same RTR commands and generate new logs.
   • DIncrease the retention period in the Falcon console settings to 18 months.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In an audit log entry for an RTR command, which field would indicate the user who executed the command?

   • ASession ID
   • BHost ID
   • CCommand ID
   • DUser ID or user name
   Reveal Solution Discussion Select an answer first