Utilize Custom Scripts in RTR to Remediate a Threat CCFR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of using a 'try/catch' block in an RTR custom script?

   • ATo encrypt the script's output
   • BTo validate the script's syntax before execution
   • CTo handle runtime errors gracefully and continue or exit appropriately
   • DTo speed up script execution
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is writing a custom RTR script that will be run on a large number of hosts. The script must handle the case where a file to be deleted is locked by another process. The analyst wants the script to retry the deletion a few times before giving up. Which script structure should the analyst use?

   • AUse a script that kills the locking process before attempting deletion.
   • BUse a try-catch block with a loop that retries the deletion up to 3 times, with a short delay between attempts.
   • CUse a script that schedules the deletion for a later time using a scheduled task.
   • DUse a single Remove-Item command with the -Force parameter.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a required step when uploading a custom script to the Falcon platform?

   • ACompiling the script into an executable file
   • BEncrypting the script with a password
   • CProviding a name and description for the script
   • DSigning the script with a code-signing certificate
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst needs to write a custom script that will run on both Windows and Linux hosts via RTR. The script must check for a specific file and delete it if found. Which approach should the analyst take?

   • AWrite two separate scripts, one in PowerShell for Windows and one in Bash for Linux, and upload both to the Scripts Library.
   • BWrite a single Bash script and run it on Windows using the Windows Subsystem for Linux (WSL).
   • CWrite a single PowerShell script and run it on Linux using PowerShell Core.
   • DWrite a single Python script that works on both platforms and upload it once.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is executing a custom script via RTR that terminates a malicious process and deletes its associated files. The script runs successfully on the first host, but on the second host it fails with a 'permission denied' error. What is the most likely cause?

   • AThe script is blocked by the host's local security policy.
   • BThe script has a syntax error that only manifests on the second host due to different OS versions.
   • CThe RTR session on the second host does not have sufficient privileges to perform the actions.
   • DThe second host has a different file path for the malicious files.
   Reveal Solution Discussion Select an answer first