A Falcon administrator is reviewing RTR audit logs and notices a user executed a command to delete a critical system file on multiple hosts. What is the administrator's primary responsibility in this situation?

Reconfigure the prevention policy to block file deletions

Verify whether the action was authorized and investigate any potential policy violation

Immediately delete the user's account to prevent further actions

Ignore the action because audit logs are only for compliance reporting

What is the primary purpose of assigning a Falcon role to a user?

To assign the user to a specific host group for policy targeting

To enable single sign-on for the user's account

To grant the user specific permissions and access within Falcon

To identify the user's department for reporting purposes

A Falcon administrator wants to enforce a security control that prevents unauthorized USB devices from being used on all Windows hosts in the environment. Which Falcon feature should the administrator configure?

Create a detection policy to alert on USB usage

Create a prevention policy with USB device control enabled

Configure a host group to exclude USB devices

Enable real-time response to manually block USB devices

A Falcon administrator needs to grant a new incident responder the ability to initiate Real-time Response (RTR) sessions on Windows hosts, but must prevent the responder from permanently deleting files or modifying registry keys. Which approach should the administrator take?

Assign the built-in Falcon Administrator role and rely on the user's training to avoid destructive actions.

Create a custom role with RTR session initiation permission but without file deletion or registry modification permissions, then assign it to the user.

Add the user to the Falcon Dashboard group and enable RTR in the prevention policy.

Assign the built-in Read-Only role and grant RTR session initiation via a host group policy.

An administrator is reviewing RTR audit logs and notices that a user with a role that allows only 'get' and 'put' commands executed a 'runscript' command. The audit log shows the command was successful. The administrator needs to determine if this was a policy violation. What should the administrator do?

Disable RTR for the host where the command was executed.

Immediately revoke the user's Falcon access.

Ignore the event because the user is trusted.

Verify the user's role permissions and the audit log entry to confirm the command was executed.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 5Objective 3

5.3 Apply Roles and Policy Settings, and Track and Review Falcon RTR Audit Logs in Order to Manage User Activity CCFA Practice Questions (Page 3)

Part of the Policy Application domain, which makes up ~17% of our current practice bank.

21questions here

5free pages

4concepts

Questions 11–15

11foundation · easy
A Falcon administrator is reviewing RTR audit logs and notices a user executed a command to delete a critical system file on multiple hosts. What is the administrator's primary responsibility in this situation?
Select an answer first
12foundation · easy
What is the primary purpose of assigning a Falcon role to a user?
Select an answer first
13foundation · easy
A Falcon administrator wants to enforce a security control that prevents unauthorized USB devices from being used on all Windows hosts in the environment. Which Falcon feature should the administrator configure?
Select an answer first
14application · medium
A Falcon administrator needs to grant a new incident responder the ability to initiate Real-time Response (RTR) sessions on Windows hosts, but must prevent the responder from permanently deleting files or modifying registry keys. Which approach should the administrator take?
Select an answer first
15expert · hard
An administrator is reviewing RTR audit logs and notices that a user with a role that allows only 'get' and 'put' commands executed a 'runscript' command. The audit log shows the command was successful. The administrator needs to determine if this was a policy violation. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.