1.1 Determine Roles Required for Access to Features and Functionality in the Falcon Console CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has a team of threat hunters who need to run custom searches across Falcon data and view raw event data, but they should NOT be able to modify detections or access host management. Which approach should the administrator take?

   • ACreate a custom role with the 'Custom IOA' and 'Event Search' permissions
   • BAssign the Falcon Responder role and disable detection updates
   • CAssign the Falcon Reader role to all threat hunters
   • DAssign the Falcon Administrator role and restrict via host groups
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator is setting up a new hire who will be responsible for monitoring the Falcon dashboard and reviewing detection summaries, but will not perform any response actions or manage policies. Which role should be assigned to this user?

   • AFalcon Responder
   • BFalcon Administrator
   • CFalcon Manager
   • DFalcon Reader
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon administrator needs to grant a user the ability to view and manage the Falcon sensor update policies, but the user should NOT have access to detections or response actions. Which built-in role should be assigned?

   • AFalcon Administrator
   • BFalcon Manager
   • CFalcon Reader
   • DFalcon Responder
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon administrator needs to grant a user the ability to view and manage IOA (Indicator of Attack) exclusions, but the user should NOT be able to view detections or manage prevention policies. Which role should be assigned?

   • AFalcon Manager
   • BFalcon Responder
   • CCreate a custom role with the 'IOA Exclusions' permission
   • DFalcon Administrator
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Falcon administrator is creating a custom role for a group of security engineers. The engineers need to manage prevention policies and sensor update policies, but they should NOT have access to detections or response actions. Which permission set should the custom role include?

   • APrevention Policies (manage), Detections (view)
   • BSensor Update Policies (manage), Host Containment
   • CPrevention Policies (manage), User Management
   • DPrevention Policies (manage), Sensor Update Policies (manage)
   Reveal Solution Discussion Select an answer first