A user needs to view detection details and manage indicators of compromise (IOCs) but should NOT be able to modify user accounts. Which role assignment is most appropriate?

Assign a custom role that includes detection viewing and IOC management permissions but excludes user management

Assign the Falcon Administrator role

In the Falcon console, what is the primary purpose of role-based access control (RBAC)?

To automatically assign every new user the highest level of access

To encrypt all data transmitted between the Falcon sensor and the cloud

To track user login times and IP addresses for audit purposes

To restrict which features and data each user can access based on their assigned role

A Falcon administrator is evaluating whether to use built-in roles or custom roles for a new security operations team. The team needs to view detections, run reports, and manage sensor update policies, but should NOT have access to response actions or user management. The administrator wants to minimize ongoing maintenance while ensuring least privilege. Which approach is most appropriate?

Assign the Falcon Manager role to the team

Create a custom role with Detections (view), Reports, and Sensor Update Policies permissions

Assign the Falcon Reader role to the team

Assign the Falcon Responder role to the team

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 1Objective 1

1.1 Determine Roles Required for Access to Features and Functionality in the Falcon Console CCFA Practice Questions (Page 2)

Part of the User Management domain, which makes up ~12% of our current practice bank.

21questions here

5free pages

5concepts

Questions 6–10

6foundation · easy
Which built-in Falcon role is designed to provide read-only access to the console?
Select an answer first
7foundation · easy
A user needs to view detection details and manage indicators of compromise (IOCs) but should NOT be able to modify user accounts. Which role assignment is most appropriate?
Select an answer first
8foundation · easy
In the Falcon console, what is the primary purpose of role-based access control (RBAC)?
Select an answer first
9application · medium
A Falcon administrator needs to grant a user the ability to manage Falcon users and assign roles, but the user should NOT have access to detections or host management. Which built-in role should be assigned?
Select an answer first
10expert · hard
A Falcon administrator is evaluating whether to use built-in roles or custom roles for a new security operations team. The team needs to view detections, run reports, and manage sensor update policies, but should NOT have access to response actions or user management. The administrator wants to minimize ongoing maintenance while ensuring least privilege. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

1.1 Determine Roles Required for Access to Features and Functionality in the Falcon Console CCFA Practice Questions (Page 2)

Questions 6–10

Which built-in Falcon role is designed to provide read-only access to the console?

A user needs to view detection details and manage indicators of compromise (IOCs) but should NOT be able to modify user accounts. Which role assignment is most appropriate?

In the Falcon console, what is the primary purpose of role-based access control (RBAC)?

A Falcon administrator needs to grant a user the ability to manage Falcon users and assign roles, but the user should NOT have access to detections or host management. Which built-in role should be assigned?

Keep studying — User Management