CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ117

VerifiedUser Management

During a Windows system investigation using Real Time Response (RTR), an RTR Active Responder cannot execute a custom PowerShell script to find particular system artifacts.

What is preventing the responder from executing the PowerShell script?

Explanation

RTR Active Responders can run authorized custom RTR scripts only when Custom Scripts is enabled in the response policy applied to the endpoint. Put-and-Run controls a separate file-transfer-and-execution function, while script-based execution monitoring in a prevention policy does not grant RTR custom-script capability.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!