CrowdStrike Falcon has three built-in Real Time Response roles: Read Only Analyst, Active Responder, and Administrator. The RTR Administrator role can do everything an Active Responder can, PLUS create and manage custom scripts, upload files with the put command, and directly execute binaries with the run command. Creating RTR custom scripts is therefore reserved for the Administrator role. Option C, 'Script Developer,' is not a real Falcon RTR role and is a distractor, and Read Only Analyst / Active Responder cannot author scripts.
Community Discussion