Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most

The correct answer is B. Real Time Responder ?Read Only Analyst. The Real Time Responder - Read Only Analyst only allows to run the commands "cat,cd,clear,env,eventlog,filehash,getsid,help,history,ipconfig,ls,mount,netstat,ps,reg" the role do not have permission to get files so it is the most aproximated profile for the requested capabilities.

User and Role Management

Question

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

Options

ARemediation Manager
BReal Time Responder ?Read Only Analyst
CFalcon Analyst ?Read Only
DReal Time Responder ?Active Responder

How the community answered

(52 responses)

A
6% (3)
B
81% (42)
C
2% (1)
D
12% (6)

Explanation

The Real Time Responder - Read Only Analyst only allows to run the commands "cat,cd,clear,env,eventlog,filehash,getsid,help,history,ipconfig,ls,mount,netstat,ps,reg" the role do not have permission to get files so it is the most aproximated profile for the requested capabilities.

Topics

#RBAC#RTR roles#least privilege#read-only analyst

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice