Set up a Workflow with RTR Custom Scripts CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which method can be used to create a custom script in the RTR script editor?

   • ABy writing script content directly in the editor or importing an existing script file
   • BBy copying a script from another Falcon tenant
   • COnly by using the built-in script templates
   • DOnly by importing a script from a local file
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A workflow runs an RTR custom script that collects network connections from hosts. The workflow has been working for months, but today it started failing on all hosts. The workflow log shows 'Script execution failed: The RTR session could not be established.' The script has not been modified. What is the most likely cause?

   • AThe script has a syntax error that was introduced by a recent Falcon platform update.
   • BThe workflow's trigger is no longer firing because the detection type has changed.
   • CThe script's permissions were changed to 'No Access' by another administrator.
   • DThe Falcon sensor on the target hosts is offline or not communicating with the CrowdStrike cloud.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A workflow is configured to run an RTR custom script that quarantines a file when a detection occurs. The workflow has been working, but the security team wants to ensure that the script only runs on hosts in the 'Production' host group and not on 'Test' hosts. The workflow currently triggers on all detections. What is the best way to restrict the workflow to Production hosts?

   • AAdd a condition to the workflow action that checks if the host is a member of the 'Production' host group.
   • BChange the workflow trigger to only fire for detections on 'Production' hosts.
   • CCreate a separate workflow for 'Test' hosts and disable the original workflow.
   • DModify the script to check the host group and exit if the host is in the 'Test' group.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a CrowdStrike Falcon workflow that integrates an RTR custom script, what is the role of a trigger?

   • AIt determines which hosts the script can run on
   • BIt defines the conditions that must be met for the script to run
   • CIt is the event that starts the workflow, such as a detection or alert
   • DIt specifies the action to be performed on the endpoint
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is it important to manage script versions in CrowdStrike Falcon?

   • ATo track changes and allow rollback to previous versions if needed
   • BTo increase the script's execution speed
   • CTo automatically share scripts with other organizations
   • DTo encrypt the script content
   Reveal Solution Discussion Select an answer first