A Falcon administrator wants to ensure that only senior incident responders can execute RTR commands that modify system state, while junior responders can only run read-only commands. What is the best way to enforce this?

Use host group policies to restrict commands based on the host OS.

Enable RTR only for senior responders by adding them to a special host group.

Assign all responders the Falcon Administrator role and rely on their judgment.

Create two custom roles: one with full RTR permissions for senior responders and one with read-only RTR permissions for junior responders.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 5Objective 3

5.3 Apply Roles and Policy Settings, and Track and Review Falcon RTR Audit Logs in Order to Manage User Activity CCFA Practice Questions (Page 5)

Part of the Policy Application domain, which makes up ~17% of our current practice bank.

21questions here

5free pages

4concepts

Questions 21–21

21application · medium
A Falcon administrator wants to ensure that only senior incident responders can execute RTR commands that modify system state, while junior responders can only run read-only commands. What is the best way to enforce this?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

5.3 Apply Roles and Policy Settings, and Track and Review Falcon RTR Audit Logs in Order to Manage User Activity CCFA Practice Questions (Page 5)

Questions 21–21

A Falcon administrator wants to ensure that only senior incident responders can execute RTR commands that modify system state, while junior responders can only run read-only commands. What is the best way to enforce this?

Keep studying — Policy Application