1.2 Create Roles and Assign Users to Roles Based on Desired Permissions CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon administrator creates a custom role named 'SOC Analyst' with permissions to view detections and manage host groups. After creating the role, the administrator needs to grant these permissions to a new hire, Priya. What is the next step the administrator should take?

   • AEdit the 'SOC Analyst' role to add Priya as a member, which will automatically create her user account.
   • BAssign Priya to the built-in 'Administrator' role temporarily until the 'SOC Analyst' role is finalized.
   • CCreate a new user account for Priya and assign the 'SOC Analyst' role to that user.
   • DCreate a new role for Priya with the same permissions as 'SOC Analyst' and assign it to her.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator is creating a role for a group of threat analysts who need to view and edit indicators of compromise (IOCs) but should NOT be able to view or modify detections. Which permissions should the administrator assign to this role?

   • APrevention Policies: Write
   • BDetections: Read
   • CIOC Management: Read and Detections: Write
   • DIOC Management: Write
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon administrator notices that a custom role named 'Endpoint Manager' currently grants users the ability to edit prevention policies. The administrator wants to restrict this role so its members can only view prevention policies, not edit them. What should the administrator do?

   • AEdit the 'Endpoint Manager' role and change the prevention policy permission from write to read, then save the changes.
   • BDelete the 'Endpoint Manager' role and create a new role with read-only prevention policy access, then reassign all users.
   • CCreate a second role with read-only access and assign it to the users, leaving the original role unchanged.
   • DRemove all users from the 'Endpoint Manager' role and then change the permissions.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A Falcon administrator is creating a new custom role in the Falcon console. Which two fields are required when defining the role?

   • AName and description
   • BPermission set and user list
   • CName and permission set
   • DDescription and user list
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Falcon administrator has a custom role named 'SOC Managers' with permissions to view all detections and manage user accounts. A manager, Taylor, is currently assigned to this role. Taylor is being promoted and will now oversee the entire security team, requiring the same permissions as the 'Administrator' role. The administrator wants to ensure Taylor has the new permissions while minimizing the risk of leaving the 'SOC Managers' role over-privileged. What should the administrator do?

   • ACreate a new role with Administrator permissions and assign it to Taylor, leaving the 'SOC Managers' role unchanged.
   • BEdit the 'SOC Managers' role to add all Administrator permissions and keep Taylor assigned to it.
   • CRemove Taylor from the 'SOC Managers' role and assign the built-in 'Administrator' role to Taylor.
   • DAssign the built-in 'Administrator' role to Taylor while keeping the 'SOC Managers' role assigned.
   Reveal Solution Discussion Select an answer first