CrowdStrike Certified Falcon Administrator (CCFA) — Question 149

A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

Answer options

• A. The host has a user logged into it
• B. The domain controller is preventing the connection
• C. They do not have an RTR role assigned to them
• D. There is another analyst connected into it

Correct answer: C

Explanation

The correct answer is C because without an RTR role assigned, the Falcon Administrator lacks the necessary permissions to initiate a Real-Time Response session. The other options, while they could potentially cause issues, do not directly prevent the administrator from starting a session if they have the appropriate role.