The likely restriction is that Custom Scripts is not enabled in the response policy. RTR permissions are controlled by both user role and response policy. An Active Responder can run certain custom scripts when the host's response policy permits Custom Scripts. If that setting is disabled, the user may have the correct RTR role but still be blocked from executing the script on that host. Put-and-Run is associated with uploading and running executables and is broader than the custom-script control. Script-Based Execution Monitoring is a prevention visibility setting, not an RTR permission. RTR Administrator is required for creating custom scripts and some higher-risk actions, but an Active Responder can execute allowed custom scripts when policy permits.

Falcon uses role-based access control. Permissions are enabled inside roles, and then those roles are assigned to users. This allows administrators to apply least privilege by creating roles that contain only the specific permissions required for a task or module. Users do not receive all permissions by default, and permissions are not generally assigned one-by-one directly to users as a primary model. The role defines what actions can be performed, such as managing users, editing policies, creating exclusions, managing custom IOAs, or using RTR capabilities. The course guide explains that custom roles are built by enabling the required permission groups and disabling unrelated permissions. This supports operational separation of duties and auditability.

A Falcon Administrator role alone does not grant the ability to initiate a Real Time Response session. RTR access is controlled by dedicated Real Time Responder roles, and the course guidance is explicit that "you must have a Real Time Responder role to connect to a host" and that "the Falcon Administrator role doesn't include access to Real Time Response." The administrator must be assigned one of the RTR roles, such as Real Time Responder - Read Only Analyst, Active Responder, or Administrator, depending on the level of command access required. A logged-in user on the endpoint does not prevent RTR connection, and Falcon can also connect to hosts that are network contained as long as RTR requirements are met. Another analyst session may affect operational coordination, but it is not the primary cause in this scenario. The correct CCFA topic alignment is User Management and Real Time Response role assignment.

The most accurate ML exclusion pattern is Program Files\Software\**\*.exe. Falcon prevention policy exclusions use glob syntax, and Windows exclusion paths are written without the drive name and without a leading backslash. The pattern must therefore begin at Program Files\Software\, not C:\Program Files\Software\. A single asterisk pattern such as Program Files\Software\*.exe matches only .exe files directly inside the Software folder and does not include subfolders. The double-asterisk pattern with a path separator, **\*.exe, is the correct recursive construction because it matches executable files within the target folder and its subdirectories. **\*.exe by itself is overly broad because it could match executable files in many locations, not just the Software directory. Program Files\Software\**.exe is less precise than the documented recursive executable pattern. Reference topics: Rule Configuration, Machine Learning Exclusions, Prevention Policy Exclusions, Glob Syntax.

Falcon quarantine is enabled through Prevention policy settings . Specifically, administrators configure Next- Gen Antivirus settings, prevention sliders, and the quarantine-related controls within the prevention policy assigned to the host. General Settings are used for tenant-wide administrative settings such as RTR MFA, not endpoint file quarantine behavior. Manual file deletion is not Falcon quarantine and lacks the controlled evidence-preserving workflow of a security product. System restore is an operating system recovery feature and is unrelated to Falcon policy enforcement. The course guide frames quarantine as part of the prevention policy stack: Falcon must first detect and prevent a malicious file, then the policy determines whether the file is quarantined on the host.