Set up a Workflow with RTR Custom Scripts CCFR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In CrowdStrike Falcon, what is the role of RTR custom scripts within a workflow?

   • AThey act as reusable actions that can be executed on endpoints as part of an automated response
   • BThey serve as triggers that initiate a workflow when an alert is generated
   • CThey define the conditions under which a workflow should execute
   • DThey provide a way to visualize workflow execution history
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a recommended practice when testing an RTR custom script in a safe environment?

   • ATest only the syntax, not the logic, of the script
   • BSkip testing if the script is short and simple
   • CUse a test host that mirrors the production environment as closely as possible
   • DRun the script on a production endpoint to see real-world results
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A workflow is configured to run an RTR custom script that collects memory dumps from hosts when a 'Critical' severity detection occurs. The workflow has been running for a week, but the security team notices that the script is not executing on any hosts. The workflow status shows 'Triggered' but the action status shows 'Skipped'. What is the most likely cause?

   • AThe script's permissions are set to 'No Access', preventing the workflow from running it.
   • BThe workflow's trigger is not configured correctly and is not firing on the detections.
   • CThe RTR script has a syntax error that prevents it from being executed.
   • DThe workflow's condition for the action is not being met, such as a host group filter that excludes the affected hosts.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An administrator is creating an RTR custom script to collect specific log files from Windows and Linux hosts. The script needs to know the path to the log file and the operating system of the host. The administrator wants the script to be reusable in multiple workflows with different log paths. What is the best way to design the script?

   • ACreate two separate scripts, one for Windows and one for Linux, each with a 'LogPath' parameter.
   • BHardcode the log path and OS detection logic directly in the script to keep it simple.
   • CUse a single parameter 'LogPath' and let the script auto-detect the OS at runtime.
   • DDefine two parameters: 'LogPath' and 'OS', and use conditional logic in the script to handle each OS.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team has developed an RTR custom script that performs memory dump analysis on compromised hosts. The script is mature and has been tested. The team wants to ensure that only senior incident responders can modify the script, while all incident responders can execute it in workflows. What is the best way to configure this?

   • AGrant all incident responders 'Write' permission and rely on the workflow's approval step to prevent unauthorized changes.
   • BSet the script's permission to 'Read' for the incident responder role and 'Write' for the senior incident responder role.
   • CRestrict the script to 'No Access' for all roles and create a workflow that runs it with elevated privileges.
   • DCreate two copies of the script: one for seniors with write access and one for all responders with read access.
   Reveal Solution Discussion Select an answer first