CCFA: CrowdStrike Certified Falcon Administrator

Question

Your CISO has decided that all Falcon Analysts must also be able to view files and file contents locally on compromised hosts, without being able to remove them from the host. What is the most appropriate role to add to fulfill this requirement?

Explanation

CrowdStrike Real Time Response read-only permissions allow investigation commands such as file listing and viewing file contents while excluding active-response file operations. The Real Time Responder – Read Only Analyst role provides that least-privilege access; Active Responder access would grant broader file-operation capabilities.

Learn more

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ188

Community Discussion