CrowdStrike Certified Falcon Administrator (CCFA) — Question 73

Why is it important to know your company's event data retention limits in the Falcon platform?

Answer options

• A. This is not necessary; you simply select "All Time" in your query to search all data
• B. You will not be able to search event data into the past beyond your retention period
• C. Data such as process records are kept for a shorter time than event data
• D. Your query will require you to specify the data pool associated with the date you wish to search

Correct answer: B

Explanation

Knowing your company's event data retention limits is crucial because it directly affects your ability to access historical event data. Answer B is correct as it highlights that any data prior to the retention period cannot be retrieved. The other options either provide incorrect information or do not address the importance of retention limits.