When assigning permissions to a custom role, what does the Falcon console allow an administrator to control?

The number of users that can be assigned to the role

The specific features and actions the role can access

The geographic region where the role can be used

The password policy for users in the role

A Falcon administrator has a custom role named 'Threat Hunters' with permissions to view detections and run real-time responses. A user named Alex is currently assigned to this role. Alex is moving to a different team and should no longer have these permissions. What should the administrator do?

Create a new role with no permissions and assign it to Alex.

Edit the 'Threat Hunters' role to remove the detections and real-time response permissions.

Remove Alex from the 'Threat Hunters' role.

Delete the 'Threat Hunters' role.

A Falcon administrator is reviewing the roles in the Falcon console and finds that a custom role named 'Temp Access' has been assigned to several users who no longer need access. The role has permissions to view detections and manage host groups. The administrator wants to clean up the role assignments without affecting other roles or users. What should the administrator do?

Create a new role with no permissions and assign it to the users who no longer need access.

Remove the users who no longer need access from the 'Temp Access' role.

Edit the 'Temp Access' role to remove all permissions.

Where in the Falcon console does an administrator navigate to create a new custom role?

Settings > User Management > Roles

Investigate > Detection Explorer

A Falcon administrator is creating a role for a compliance officer who needs to view audit logs and detection summaries but must NOT have access to any management functions. Which permissions should the administrator assign to this role?

Audit Logs: Write and Detections: Write

Audit Logs: Read and Detections: Read

Sensor Management: Read and Host Groups: Write

Prevention Policies: Read and Real-Time Response: Write

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 1Objective 2

1.2 Create Roles and Assign Users to Roles Based on Desired Permissions CCFA Practice Questions (Page 2)

Part of the User Management domain, which makes up ~12% of our current practice bank.

21questions here

5free pages

4concepts

Questions 6–10

6foundation · easy
When assigning permissions to a custom role, what does the Falcon console allow an administrator to control?
Select an answer first
7application · easy
A Falcon administrator has a custom role named 'Threat Hunters' with permissions to view detections and run real-time responses. A user named Alex is currently assigned to this role. Alex is moving to a different team and should no longer have these permissions. What should the administrator do?
Select an answer first
8expert · hard
A Falcon administrator is reviewing the roles in the Falcon console and finds that a custom role named 'Temp Access' has been assigned to several users who no longer need access. The role has permissions to view detections and manage host groups. The administrator wants to clean up the role assignments without affecting other roles or users. What should the administrator do?
Select an answer first
9foundation · easy
Where in the Falcon console does an administrator navigate to create a new custom role?
Select an answer first
10application · medium
A Falcon administrator is creating a role for a compliance officer who needs to view audit logs and detection summaries but must NOT have access to any management functions. Which permissions should the administrator assign to this role?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.