Set up a Workflow with RTR Custom Scripts CCFR Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A workflow that runs an RTR custom script to collect forensic artifacts from Windows endpoints is failing intermittently. The workflow triggers on a new detection and passes the host ID and a timestamp as parameters. The script works when run manually from the RTR console on the same hosts. The workflow logs show 'Script execution failed: Parameter validation error.' What is the most likely cause?

   • AThe workflow is passing the timestamp in a format that does not match the script's expected parameter type.
   • BThe script's permissions are set to 'Read' only, preventing the workflow from executing it.
   • CThe host ID parameter is empty because the workflow trigger does not provide the host ID.
   • DThe script has a syntax error that only manifests when executed by the workflow engine.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common cause of RTR custom script execution failure?

   • AThe script contains syntax errors
   • BThe script uses too many parameters
   • CThe script is not encrypted
   • DThe script is too long
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When configuring parameters for an RTR custom script, what is the purpose of defining a default value?

   • ATo limit the parameter to a specific set of allowed values
   • BTo encrypt the parameter value for security
   • CTo provide a value that is used when the user does not supply one
   • DTo ensure the script always uses the same value regardless of input
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When setting up a workflow with an RTR custom script, what is the purpose of defining conditions?

   • ATo specify which endpoints the script should run on
   • BTo define the script's input parameters
   • CTo schedule when the workflow runs
   • DTo determine whether the workflow should proceed based on certain criteria
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A workflow that runs an RTR custom script to terminate a malicious process is failing on some hosts but not others. The script uses the parameter 'ProcessID'. The workflow passes the ProcessID from the detection event. On the failing hosts, the workflow log shows 'Script execution failed: The process does not exist.' The script works when run manually with the same ProcessID on the same hosts. What is the most likely reason for the discrepancy?

   • AThe workflow is passing the ProcessID as a string instead of an integer, causing the script to fail on some hosts.
   • BThe script's permissions are set to 'Read' only, preventing it from terminating processes on some hosts.
   • CThe script has a syntax error that only appears on certain hosts due to different PowerShell versions.
   • DThe process had already exited or was terminated by another security control before the workflow executed the script.
   Reveal Solution Discussion Select an answer first