CrowdStrike Exam CCFA-200 Topic 2 Question 15 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam

Question #: 15
Topic #: 2

A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

AThe host has a user logged into it

BThe domain controller is preventing the connection

CThey do not have an RTR role assigned to them

DThere is another analyst connected into it

Show Suggested Answer

Suggested Answer: C

by Claribel at Feb 02, 2023, 08:16 AM

Limited Time Offer

25%

Off

Get Premium CCFA-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Katina

3 days ago

D is my pick. Chances are, another analyst is already connected to the host, and that's preventing the Falcon Admin from establishing a session.

upvoted 0 times

...

Alberta

5 days ago

I'm going to go with option A. The host might have a user logged in, and that could be blocking the Real-Time Response session.

upvoted 0 times

...

Fatima

7 days ago

Option C seems the most plausible. If the admin doesn't have the RTR role assigned, they won't be able to establish the connection.

upvoted 0 times

...

Charlene

8 days ago

I think the most likely cause is that the domain controller is preventing the connection. It's a common issue with Real-Time Response.

upvoted 0 times

...

Leonora

14 days ago

But what if the host doesn't have an RTR role assigned to them? That could also be a possible cause, right?

upvoted 0 times

...

Basilia

15 days ago

I agree with Gaston, having a user logged in could be the reason why the Falcon Administrator is unable to connect.

upvoted 0 times

...

Gaston

18 days ago

I think the most likely cause is that the host has a user logged into it.

upvoted 0 times

...