Set up a Workflow with RTR Custom Scripts CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An administrator has created a new RTR custom script that will be used in a workflow to collect browser history. The script has been tested on a single test host and works correctly. Before deploying it in the production workflow, what additional step should the administrator take to ensure the script is safe for broad use?

   • ATest the script on a small group of non-production hosts with varied configurations to ensure it handles different environments.
   • BDeploy the script in the production workflow and monitor the first few executions for errors.
   • CReview the script's code to ensure it follows best practices, then deploy it immediately.
   • DSet the script's permissions to 'Read' only for all users to prevent accidental modification.
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   An administrator needs to create an RTR custom script that will be used to collect running processes from Windows hosts. The script should accept a parameter for the output file name. The administrator has the script content ready. What is the correct sequence of steps to create and prepare this script for use?

   • ACreate a new script in the RTR script editor, paste the content, define the output file name parameter, and save the script.
   • BWrite the script in a text editor, save it as a .ps1 file, and then import it into the RTR library.
   • CUpload the script file to the Falcon console and then create a workflow to reference it.
   • DCreate a new workflow, paste the script content into the action, and define the parameter in the workflow settings.
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A security operations center (SOC) manager wants to reduce the manual effort required to respond to common threats. The manager has heard that CrowdStrike Falcon can automate response actions using RTR custom scripts. What is the primary benefit of using RTR custom scripts in a workflow?

   • AThey allow the SOC to run any command on any host without requiring the Falcon sensor to be installed.
   • BThey enable automated, consistent execution of response actions across many hosts without manual intervention.
   • CThey provide a graphical interface for writing and testing scripts without any coding knowledge.
   • DThey replace the need for any human oversight in the incident response process.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst wants to automate the quarantine of a file on multiple Windows endpoints whenever Falcon detects a specific malware hash. The analyst has already written a PowerShell script that takes the file path as an input parameter and uses the Falcon sensor's quarantine API. The analyst now needs to make this script available for use in a Falcon workflow. Which two configuration steps are required before the script can be selected as an action in the workflow?

   • AEnable the script for workflow use in the RTR settings and then create a new workflow with a manual trigger to test it.
   • BCreate a new workflow, add the script as a trigger, and then write the script content directly in the workflow action.
   • CUpload the script to the RTR script library and define the file path as a parameter in the script editor.
   • DPublish the script to the Falcon console and assign it a static file path in the script editor to avoid runtime errors.
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A junior analyst needs to create an RTR custom script that collects specific registry keys from Windows hosts. The analyst has the script content in a text file on their local machine. What is the correct way to add this script to the Falcon console?

   • AUpload the text file directly to the Falcon console using the 'Upload Script' button in the RTR library.
   • BCreate a new workflow and paste the script content into the workflow's action field.
   • CUse the RTR script editor to create a new script and paste the content from the text file.
   • DEmail the script content to CrowdStrike support and request they add it to the tenant.
   Reveal Solution Discussion Select an answer first