Utilize Custom Scripts in RTR to Remediate a Threat CCFR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst needs to deploy a custom remediation script to 50 Windows hosts. The script must be signed by the organization's code-signing certificate and must be available to all Falcon users with RTR permissions. The analyst has already written the script and tested it locally. Which action should the analyst take in the Falcon console?

   • AEmbed the script directly in a custom IOA rule and deploy it via prevention policy.
   • BUpload the script to the Falcon platform via the Scripts Library, then reference it in an RTR session.
   • CSend the script to each host via email and run it manually with PowerShell.
   • DCreate a new RTR session per host and paste the script inline each time.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How are parameters passed to a custom script when executing it in an RTR session?

   • ABy appending them to the run command in the RTR console
   • BBy using a separate configuration file
   • CBy setting environment variables on the host
   • DBy editing the script file before each execution
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An incident responder is using RTR to remediate a worm that spreads via a scheduled task on Windows hosts. The task runs a malicious PowerShell command every 5 minutes. The responder has an RTR session open on an infected host. The remediation script must remove the scheduled task, kill any running PowerShell processes that are executing the malicious command, and delete the associated script file. The responder is concerned about accidentally killing legitimate PowerShell processes. Which script logic should the responder use?

   • ADisable the scheduled task, then delete the file, and rely on the task to fail naturally.
   • BIdentify the specific process ID (PID) of the malicious PowerShell process, then kill that PID, remove the scheduled task, and delete the file.
   • CRemove the scheduled task first, then kill all PowerShell processes and delete the file.
   • DKill all PowerShell processes, then remove the scheduled task and delete the file.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's security policy requires that all RTR script executions be logged and attributable to a specific user. Which Falcon feature ensures this requirement is met?

   • AThe script's output, which is stored in the host's local event log.
   • BThe RTR audit log, which records the user, host, script, and timestamp of each execution.
   • CThe host's security event log, which records all process executions.
   • DThe Falcon dashboard, which shows real-time RTR sessions but does not retain historical logs.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst uploads a custom PowerShell script to the Falcon Scripts Library. When running it via RTR on a Windows host, the script fails with a syntax error. The analyst checks the script and finds a typo. After fixing the typo, what must the analyst do to ensure the corrected version is used?

   • AEdit the script directly on the target host and re-run it from the local file system.
   • BDelete the script from the library and re-create it with the same name.
   • CUpload the corrected script as a new version in the Scripts Library and re-run the RTR command.
   • DRe-run the same RTR command; the platform automatically re-compiles the script.
   Reveal Solution Discussion Select an answer first