Set up a Workflow with RTR Custom Scripts CCFR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Falcon administrator is creating an RTR custom script that will be used in multiple workflows. The script needs to perform different actions based on the operating system of the target host. The administrator wants to avoid creating separate scripts for Windows and Linux. What is the best approach?

   • AWrite the script to detect the OS automatically without any parameters, and use it in all workflows.
   • BUse a workflow condition to set an environment variable that the script reads to determine the OS.
   • CCreate two separate scripts, one for Windows and one for Linux, and use a workflow condition to select the correct one.
   • DDefine a parameter called 'OS' in the script and use conditional logic within the script to execute the appropriate commands.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important to test an RTR custom script in a safe environment before deploying it in production?

   • ATo ensure the script is compatible with all operating systems
   • BTo verify that the script works as expected and does not cause unintended harm
   • CTo automatically generate a report for compliance purposes
   • DTo reduce the script's execution time
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team has created an RTR custom script that is used in a workflow to block malicious IP addresses. The script is working well, but the team wants to ensure that only the senior incident responders can modify the script, while all incident responders can view and use it. What is the correct permission configuration?

   • AGrant 'No Access' to all roles and create a service account with 'Write' permission for the workflow.
   • BCreate two versions of the script: one with 'Read' for all and one with 'Write' for seniors.
   • CGrant 'Write' permission to all incident responders and rely on the workflow's approval process to prevent misuse.
   • DGrant 'Read' permission to the incident responder role and 'Write' permission to the senior incident responder role.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team has a critical RTR custom script that is used in a production workflow. The script was working correctly, but after a recent update to version 3, the workflow started failing. The team needs to restore service quickly while they investigate the issue. What is the best course of action?

   • ACreate a new script with the version 2 content and update the workflow to use the new script.
   • BDisable the workflow entirely until the script issue is resolved.
   • CRevert the script to version 2 in the script library, which was known to work, and re-test the workflow.
   • DEdit version 3 in place to fix the bug and immediately re-enable the workflow.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of RTR custom scripts in CrowdStrike Falcon?

   • ATo store forensic evidence for legal proceedings
   • BTo automate response actions on endpoints by executing custom commands or scripts
   • CTo replace the need for human analysts in incident response
   • DTo provide a graphical interface for managing endpoint firewall rules
   Reveal Solution Discussion Select an answer first