7.2 Understand the Different Audit Logs and Their Use Cases CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An administrator is reviewing an audit log entry and sees the 'Target' field is 'policy_123'. What does this field represent?

   • AThe timestamp of the action
   • BThe IP address of the user
   • CThe user who performed the action
   • DThe policy that was affected by the action
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator needs to provide a report of all API calls made to the Falcon API in the last 30 days for a security review. Which audit log should they export?

   • AAudit Log (User)
   • BAudit Log (Administrator)
   • CAudit Log (Auth)
   • DAudit Log (API)
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a Falcon audit log entry, what does the 'actor' field typically represent?

   • AThe timestamp of when the action occurred
   • BThe severity level of the action
   • CThe target resource affected by the action
   • DThe user or system that performed the action
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon administrator is preparing for an external audit and needs to provide a record of all changes made to the Falcon console configuration, including who made the changes and when. Which audit log should they use to generate this report?

   • AAudit Log (Auth)
   • BAudit Log (API)
   • CAudit Log (Administrator)
   • DAudit Log (User)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator is reviewing an audit log entry that shows an action taken by a user named 'jsmith'. The entry includes a timestamp, the action 'policy_updated', and the IP address of the user. What additional information is typically included in this entry to provide context?

   • AThe user's password hash
   • BThe user's social security number
   • CThe user's full name
   • DThe name of the policy that was updated
   Reveal Solution Discussion Select an answer first