1.3 Manage API Keys CCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An administrator is creating an API key for a new security orchestration tool that will be used to isolate hosts and retrieve detection details. The tool should not be able to modify prevention policies. What scopes should be assigned to the key?

   • ADetections write and Hosts read.
   • BHosts write, Detections read, and Prevention Policies write.
   • CHosts write (for isolation) and Detections read.
   • DHosts read and Detections read.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the immediate effect of revoking an API key in the Falcon console?

   • AThe key is marked as inactive but can still be used for read-only requests
   • BThe key is deactivated and can no longer be used to authenticate API requests
   • CThe key is permanently deleted from the console and cannot be recreated
   • DThe key's permissions are reset to the default read-only scope
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it important to assign API keys the minimum required permissions rather than broad administrative scopes?

   • ATo prevent the API key from being rotated automatically
   • BTo reduce the risk of unauthorized actions if the key is compromised
   • CTo make the API key easier to remember for administrators
   • DTo ensure the API key works with all Falcon APIs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Falcon administrator notices unusual activity in the audit logs: an API key is making API calls at 3:00 AM, which is outside the normal business hours when the associated integration runs. The calls are failing with permission errors. What should the administrator do first?

   • ARevoke the API key immediately and investigate the source of the calls.
   • BIncrease the permissions on the API key so the calls succeed.
   • CIgnore the activity since the calls are failing with permission errors.
   • DRotate the API key and update the integration with the new key.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   An administrator discovers that an API key used by a former employee's personal script is still active. The employee has left the company, and the script is no longer in use. What is the most immediate and appropriate action?

   • AMonitor the API key for 30 days before revoking it to ensure no legitimate processes depend on it.
   • BRevoke the API key immediately.
   • CDisable the employee's user account and leave the API key active for auditing.
   • DRotate the API key and store the new key in the employee's vault.
   Reveal Solution Discussion Select an answer first