Utilize Custom Scripts in RTR to Remediate a Threat CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which PowerShell cmdlet would a custom script use to delete a malicious file from a host?

   • ARemove-Item
   • BGet-Content
   • CNew-Item
   • DStop-Process
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of the 'ValidateSet' attribute in a PowerShell script used in RTR?

   • ATo validate the script's syntax before execution
   • BTo ensure the script runs with administrative privileges
   • CTo restrict a parameter to a predefined set of valid values
   • DTo encrypt the script's parameters
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has a strict policy that custom scripts must be signed by the organization's code-signing certificate before they can be executed via RTR. An analyst has uploaded a script to the Scripts Library but has not signed it. When the analyst attempts to run the script, it fails. What is the most likely reason for the failure?

   • AThe Falcon platform enforces the organization's script-signing policy and blocks execution of unsigned scripts.
   • BThe analyst does not have permission to run scripts in the Scripts Library.
   • CThe script is too large to be executed via RTR.
   • DThe script has a syntax error that prevents it from running.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst needs to write a custom script that will be executed via RTR on a Windows host. The script must accept a parameter for the file path to delete. Which script structure is correct?

   • ARemove-Item -Path $env:FilePath -Force
   • Bfunction Delete-File { Remove-Item -Path $FilePath -Force } ; Delete-File
   • Cparam($FilePath) ; Remove-Item -Path $FilePath -Force
   • DRemove-Item -Path $args[0] -Force
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is running an RTR script that deletes a specific malware file from a Windows host. The script completes but the output shows 'File not found'. The analyst confirms the file exists on the host. Which step should the analyst take next?

   • AReboot the host and re-run the script to ensure the file is not locked by another process.
   • BRe-run the script with elevated privileges using the 'runas' command.
   • CCheck the script's working directory and ensure the path is absolute or correctly relative to the RTR session's default location.
   • DVerify the script's syntax by running it in a local PowerShell console on the analyst's machine.
   Reveal Solution Discussion Select an answer first