CrowdStrike Certified Falcon Administrator (CCFA) — Question 213

What least privilege role should be given to a user who needs to extract files with RTR?

Answer options

• A. Real Time Responder - Active Responder
• B. Falcon Analyst
• C. Falcon Security Lead
• D. Real Time Responder - Administrator

Correct answer: A

Explanation

The correct answer is A, as the Real Time Responder - Active Responder role is specifically designed for users who need to extract files without having full administrative privileges. Options B and C offer broader access that goes beyond just file extraction, while D provides administrative capabilities that are not necessary for the user's specific task.