1.3 Manage API Keys CCFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is performing a scheduled API key rotation. An administrator has created a new key and updated the primary integration. However, the administrator discovers that a secondary disaster recovery (DR) site still uses the old key and cannot be updated for 24 hours. What should the administrator do?

   • ADisable the DR site's integration until the new key can be deployed.
   • BRevoke the old key immediately and accept the DR site outage.
   • CDelay the revocation of the old key for 24 hours and then revoke it.
   • DCreate a second new key for the DR site and update it immediately.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of regularly rotating API keys in CrowdStrike Falcon?

   • ATo ensure the API key remains compatible with the latest Falcon API version
   • BTo change the permissions associated with the key automatically
   • CTo increase the API rate limit for the integration
   • DTo reduce the window of opportunity if a key is exposed or compromised
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An administrator is investigating a potential security incident. The audit logs show that an API key was used to download a large amount of host data over the weekend. The key is assigned to a read-only integration that normally runs during business hours. The administrator needs to determine if this was unauthorized activity. What is the most important next step?

   • AIgnore the activity since the key is read-only.
   • BIncrease the permissions on the API key to see what data was accessed.
   • CRevoke the API key immediately.
   • DCheck the audit logs for the source IP address and user agent of the API calls.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Falcon administrator is reviewing API key usage and notices that a key with read-only permissions is making a high volume of API calls that are consuming significant resources. The key is assigned to a development team's integration. The administrator needs to reduce the resource consumption without breaking the integration. What should the administrator do?

   • ARevoke the API key and create a new one with lower rate limits.
   • BDisable the API key temporarily to stop the resource consumption.
   • CReduce the permissions on the API key to limit the data it can access.
   • DReview the integration's code to identify and fix inefficient API call patterns.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Falcon console feature allows an administrator to review the actions performed by a specific API key?

   • AThe API key management page, which shows a log of all API calls
   • BThe Falcon audit log, which records API activity and administrative actions
   • CThe sensor event log, which records all API requests from endpoints
   • DThe Falcon dashboard, which displays real-time API usage graphs
   Reveal Solution Discussion Select an answer first