1.3 Manage API Keys CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When should an administrator revoke an API key in CrowdStrike Falcon?

   • AWhen the key's permissions need to be changed
   • BWhen the key's name no longer reflects its purpose
   • CWhen the key has been used for more than 90 days
   • DWhen the key is no longer needed or is suspected of being compromised
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An administrator is creating an API key for a partner integration that needs to read detection data and update the status of detections. The integration should not be able to read or modify host data. Which scopes should be assigned?

   • ADetections read, Detections write, and Hosts read.
   • BDetections read and Hosts read.
   • CDetections read and Detections write.
   • DDetections write and Hosts write.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An administrator is creating an API key for a script that only needs to read host information. Which permission assignment best follows the principle of least privilege?

   • AAssign 'Detections: Read' instead, as it covers all read operations
   • BAssign only the 'Hosts: Read' permission
   • CAssign all available permissions so the script can handle future needs
   • DAssign 'Hosts: Read' and 'Hosts: Write' to allow for future modifications
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An administrator needs to create a new API key in the Falcon console for a custom integration. What must be specified during the creation process?

   • AThe user account that will own the key and a one-time password
   • BThe Falcon sensor version and the operating system of the integration server
   • CThe API key's expiration date and the IP addresses allowed to use it
   • DA name for the API key and the permissions (scopes) it will have
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   An administrator is decommissioning a test environment and needs to clean up all associated API keys. The administrator has identified three API keys that were created for the test environment. What is the correct action for each key?

   • ARotate all three API keys and store them in a secure vault.
   • BRevoke two keys and keep one active for potential future testing.
   • CDisable the test environment and leave the API keys active for monitoring.
   • DRevoke all three API keys.
   Reveal Solution Discussion Select an answer first