An organization's security team has a custom script that removes a specific registry key associated with malware. The script is sensitive and should only be run by senior incident responders. How should the analyst configure the script in the Falcon platform?

Store the script in a shared network drive and share the path with the team.

Restrict the script's permissions in the Scripts Library to only the senior incident responder group.

Encrypt the script with a password and share the password only with senior responders.

Create a custom IOA rule that triggers the script automatically when the registry key is detected.

An incident responder is running a custom script via RTR that deletes a malicious service on a Windows host. The script uses the 'sc.exe delete' command. The script fails with an error indicating that the service is marked for deletion. What is the most likely cause?

The service name is misspelled in the script.

The service is protected by the operating system.

The script does not have administrative privileges.

The service is still running, and Windows requires it to be stopped before deletion.

Where in the Falcon platform does a user upload a custom script for use in RTR sessions?

The 'Detection' page under 'Investigate'

The 'Custom Scripts' library within the Real Time Response section

The 'Falcon Console' under 'Hosts'

The 'API Clients' page under 'Support'

An analyst runs a custom script via RTR that is supposed to terminate a process and delete a file. The script output shows that the process was terminated, but the file deletion failed. The analyst needs to determine why the file deletion failed. What should the analyst do first?

Re-run the script with elevated privileges to bypass any permission issues.

Manually attempt to delete the file using the RTR shell to see the error.

Reboot the host and re-run the script to clear any file locks.

Check the script's error handling to see if it captured the specific error message for the file deletion step.

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 6Objective 5

Utilize Custom Scripts in RTR to Remediate a Threat CCFR Practice Questions (Page 1)

Part of the Real Time Response (RTR) domain, which makes up ~34% of our current practice bank.

27questions here

6free pages

6concepts

Questions 1–5

1application · medium
An organization's security team has a custom script that removes a specific registry key associated with malware. The script is sensitive and should only be run by senior incident responders. How should the analyst configure the script in the Falcon platform?
Select an answer first
2expert · hard
An incident responder is running a custom script via RTR that deletes a malicious service on a Windows host. The script uses the 'sc.exe delete' command. The script fails with an error indicating that the service is marked for deletion. What is the most likely cause?
Select an answer first
3foundation · easy
Which PowerShell cmdlet would a custom script use to terminate a malicious process on a Windows host?
Select an answer first
4foundation · easy
Where in the Falcon platform does a user upload a custom script for use in RTR sessions?
Select an answer first
5application · medium
An analyst runs a custom script via RTR that is supposed to terminate a process and delete a file. The script output shows that the process was terminated, but the file deletion failed. The analyst needs to determine why the file deletion failed. What should the analyst do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.