1.2 Create Roles and Assign Users to Roles Based on Desired Permissions CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An administrator creates a role for junior analysts. Which permission assignment best aligns with the principle of least privilege?

   • AGrant only the permissions needed for their daily tasks
   • BGrant permissions identical to senior administrators
   • CGrant no permissions and assign users later
   • DGrant full administrative permissions to all features
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A Falcon administrator needs to create a role for a group of incident responders. The role must allow them to view and edit host groups, but they should not have access to detections or prevention policies. What is the first step the administrator should take in the Falcon console?

   • ANavigate to the Roles page, click 'Create role', and enter a name and description for the role.
   • BNavigate to the Users page and create a new user for each incident responder.
   • CNavigate to the Host Groups page and configure access control lists for the incident responders.
   • DNavigate to the Prevention Policies page and create a new policy for the incident responders.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An administrator needs to remove a role that is no longer used. What must be considered before deleting the role?

   • AThe Falcon console will require a system restart
   • BAll hosts managed by the role will be deleted
   • CThe role's name will be permanently reserved
   • DUsers assigned to the role will lose the permissions granted by that role
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Falcon administrator has a custom role named 'Sensor Operators' with permissions to manage sensors and view host groups. The administrator needs to add a new permission to this role so that members can also view detections. What should the administrator do?

   • ACreate a new role with the detections read permission and assign it to the members of 'Sensor Operators'.
   • BDelete the 'Sensor Operators' role and create a new role with all required permissions.
   • CEdit the 'Sensor Operators' role and add the 'Detections: Read' permission.
   • DAssign the members of 'Sensor Operators' to the built-in 'Read Only' role.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the effect of assigning a user to a role in the Falcon console?

   • AThe user inherits all permissions granted to that role
   • BThe user's password is reset
   • CThe user's existing permissions are removed
   • DThe user must confirm the assignment via email
   Reveal Solution Discussion Select an answer first