CrowdStrike Certified Falcon Administrator (CCFA) — Question 4

Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

Answer options

• A. Real Time Responder
• B. Endpoint Manager
• C. Falcon Investigator
• D. Remediation Manager

Correct answer: A

Explanation

The 'Real Time Responder' role provides the necessary permissions to connect directly to hosts and gather real-time data. The other roles, while important for various administrative and investigative tasks, do not grant the same level of access to host connections and real-time data collection.