Which audit log use case is best served by reviewing the Falcon Audit Log for entries with the action type 'user.login'?

Tracking administrative actions

When interpreting a Falcon audit log entry, what does the 'action' field indicate?

The specific operation that was performed

An administrator needs to filter audit log entries to show only actions performed by a specific user. Where in the audit log interface can they apply this filter?

Using the search bar and selecting the 'Actor' field

By exporting the log to CSV and sorting in Excel

By creating a custom report in the Dashboard

By contacting CrowdStrike support

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 7Objective 2

7.2 Understand the Different Audit Logs and Their Use Cases CCFA Practice Questions (Page 2)

Part of the Dashboards and Reports domain, which makes up ~5% of our current practice bank.

19questions here

4free pages

4concepts

Questions 6–10

6foundation · easy
Which audit log use case is best served by reviewing the Falcon Audit Log for entries with the action type 'user.login'?
Select an answer first
7application · medium
An administrator is reviewing an audit log entry and sees the 'Action' field is 'policy_updated'. What does this action indicate?
Select an answer first
8foundation · easy
When interpreting a Falcon audit log entry, what does the 'action' field indicate?
Select an answer first
9foundation · easy
Which Falcon console audit log is specifically designed to record changes made by administrators to the Falcon tenant configuration, such as modifying detection policies or user roles?
Select an answer first
10application · medium
An administrator needs to filter audit log entries to show only actions performed by a specific user. Where in the audit log interface can they apply this filter?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

7.2 Understand the Different Audit Logs and Their Use Cases CCFA Practice Questions (Page 2)

Questions 6–10

Which audit log use case is best served by reviewing the Falcon Audit Log for entries with the action type 'user.login'?

An administrator is reviewing an audit log entry and sees the 'Action' field is 'policy_updated'. What does this action indicate?

When interpreting a Falcon audit log entry, what does the 'action' field indicate?

Which Falcon console audit log is specifically designed to record changes made by administrators to the Falcon tenant configuration, such as modifying detection policies or user roles?

An administrator needs to filter audit log entries to show only actions performed by a specific user. Where in the audit log interface can they apply this filter?

Keep studying — Dashboards and Reports