CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ52

VerifiedPolicy Application

During a Windows system investigation using Real Time Response (RTR), an RTR Active Responder cannot run a custom PowerShell script to locate specific system artifacts.

What is most likely preventing the responder from executing the PowerShell script?

Explanation

The RTR response policy must have Custom Scripts enabled to allow an Active Responder to execute a custom PowerShell script. Put-and-Run controls a different capability: placing files on an endpoint and running them.

Community Discussion

No comments yet. Be the first to start the discussion!