Utilize Custom Scripts in RTR to Remediate a Threat CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst needs to remediate a threat on a Windows host by deleting a specific registry value. The analyst has an RTR session open. Which script command should the analyst use?

   • ARemove-RegistryValue -Path 'HKLM:\Software\Malware\Value'
   • Breg delete 'HKLM:\Software\Malware\Value' /f
   • CRemove-Item -Path 'HKLM:\Software\Malware\Value' -Force
   • DDelete-Item -Path 'HKLM:\Software\Malware\Value' -Force
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   After executing a custom script in RTR, where can the responder view the script's output?

   • AIn an email notification
   • BIn the Windows Event Log on the host
   • CIn the RTR session window under the 'Output' tab
   • DIn the Falcon console's 'Activity' page
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the 'Falcon RTR Script' permission in CrowdStrike Falcon?

   • ATo allow users to view host details
   • BTo enable users to create new RTR sessions
   • CTo control which users can create, modify, and execute custom scripts
   • DTo grant users access to the Falcon API
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which scripting language is natively supported for custom scripts used in CrowdStrike Falcon Real Time Response (RTR)?

   • APython
   • BVBScript
   • CPowerShell
   • DJavaScript
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In an RTR custom script, what is the purpose of the 'Write-Output' cmdlet?

   • ATo write a file to the host's disk
   • BTo display a message to the user on the host's screen
   • CTo send the script's output back to the Falcon console for review
   • DTo log errors to the Windows Event Log
   Reveal Solution Discussion Select an answer first