CrowdStrike Certified Falcon Administrator (CCFA) — Question 123

Which user role will NOT enable the user to connect to a host using Real Time Response?

Answer options

• A. Real Time Response -Administrator
• B. Real Time Response - Active Responder
• C. Real Time Response - Read-Only Analyst
• D. Falcon Administrator

Correct answer: D

Explanation

The Falcon Administrator role has broader management permissions but does not include the capability to connect to a host using Real Time Response. In contrast, the other roles specifically include permissions that allow for host connectivity and action execution through Real Time Response.