When creating a custom role in Falcon, what must an administrator do to define the role's access?

Assign the role to a group of users

Write a script that defines the role's capabilities

Select the specific permissions that the role should grant

Copy an existing user's permissions

A security operations center (SOC) has a tier-1 analyst who needs to view alerts and run reports, but should not have access to any response actions or policy management. The SOC manager wants to ensure the analyst has the least privilege possible. Which role assignment is most appropriate?

Assign the Falcon Responder role

Create a custom role with only the 'Reports' permission

A Falcon administrator is troubleshooting why a user with the Falcon Reader role cannot see the 'Prevention Policies' section in the console. What is the most likely reason for this?

The user's role does not include the 'Prevention Policies' permission

The user's account is not assigned to any host groups

The user's session has expired and needs to re-authenticate

The Prevention Policies section is only visible to users with the Falcon Administrator role

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 1Objective 1

1.1 Determine Roles Required for Access to Features and Functionality in the Falcon Console CCFA Practice Questions (Page 4)

Part of the User Management domain, which makes up ~12% of our current practice bank.

21questions here

5free pages

5concepts

Questions 16–20

16foundation · easy
Which of the following is a predefined built-in role in the Falcon console?
Select an answer first
17foundation · easy
When creating a custom role in Falcon, what must an administrator do to define the role's access?
Select an answer first
18application · medium
A security operations center (SOC) has a tier-1 analyst who needs to view alerts and run reports, but should not have access to any response actions or policy management. The SOC manager wants to ensure the analyst has the least privilege possible. Which role assignment is most appropriate?
Select an answer first
19foundation · easy
A user with the Analyst role needs to view detection details. Which feature will this role grant access to?
Select an answer first
20application · medium
A Falcon administrator is troubleshooting why a user with the Falcon Reader role cannot see the 'Prevention Policies' section in the console. What is the most likely reason for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

1.1 Determine Roles Required for Access to Features and Functionality in the Falcon Console CCFA Practice Questions (Page 4)

Questions 16–20

Which of the following is a predefined built-in role in the Falcon console?

When creating a custom role in Falcon, what must an administrator do to define the role's access?

A security operations center (SOC) has a tier-1 analyst who needs to view alerts and run reports, but should not have access to any response actions or policy management. The SOC manager wants to ensure the analyst has the least privilege possible. Which role assignment is most appropriate?

A user with the Analyst role needs to view detection details. Which feature will this role grant access to?

A Falcon administrator is troubleshooting why a user with the Falcon Reader role cannot see the 'Prevention Policies' section in the console. What is the most likely reason for this?

Keep studying — User Management