1.2 Create Roles and Assign Users to Roles Based on Desired Permissions CCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A Falcon administrator has a custom role named 'Endpoint Admins' with permissions to manage sensors and host groups. The administrator needs to grant these permissions to a new user, Sam, who is joining the endpoint management team. What should the administrator do?

   • AAssign Sam to the built-in 'Administrator' role temporarily.
   • BEdit the 'Endpoint Admins' role to add Sam as a member.
   • CCreate a user account for Sam and assign the 'Endpoint Admins' role to that account.
   • DCreate a new role with the same permissions as 'Endpoint Admins' and assign it to Sam.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Falcon administrator is reviewing roles and notices that a custom role named 'Legacy Admin' has excessive permissions, including the ability to delete users. The role is assigned to three users who no longer need these permissions. The administrator wants to revoke these permissions while keeping the role for future use. What should the administrator do?

   • ARemove the three users from the 'Legacy Admin' role.
   • BCreate a new role with minimal permissions and assign it to the three users, leaving 'Legacy Admin' unchanged.
   • CEdit the 'Legacy Admin' role to remove the user deletion permission and any other excessive permissions.
   • DDelete the 'Legacy Admin' role and create a new role with minimal permissions.
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A Falcon administrator is creating a custom role for a team that manages Falcon sensors. The team needs to install and uninstall sensors, but they should NOT be able to view or modify detection-related settings. Which permission should the administrator assign to this role?

   • ADetections: Read
   • BSensor Management: Write
   • CPrevention Policies: Write
   • DHost Groups: Read
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of editing an existing role in the Falcon console?

   • ATo delete hosts associated with the role
   • BTo change the username of users in the role
   • CTo reset passwords for users in the role
   • DTo change the permissions granted to all users assigned to that role
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Falcon administrator is setting up roles for a new security operations center (SOC). The SOC has three teams: Tier 1 analysts who only view detections, Tier 2 analysts who view and edit detections, and managers who view everything. The administrator wants to minimize the number of roles while ensuring each team has the appropriate permissions. What should the administrator do?

   • ACreate one custom role with detections write and assign it to all three teams.
   • BUse the built-in 'Administrator' role for managers and create one custom role for both Tier 1 and Tier 2 analysts.
   • CCreate three custom roles: one with detections read, one with detections write, and one with all permissions.
   • DCreate two custom roles: one with detections read and one with detections write, then assign managers to both roles.
   Reveal Solution Discussion Select an answer first