Question 1

On the Host management page which filter could be used to quickly identify all devices categorized as a "Workstation" by the Falcon Platform?

Options :

A : Hostname

B : Status

C : Type

D : Platform

Answer: C

Question 2

You have a Windows host on your network in

Reduced functionality mode (RFM). While the

system is in RFM, which of the following is TRUE?

Options :

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventions

will not be triggered

Answer: D

Question 3

When the Notify End Users policy setting is turned on, which of the following is TRUE?

Options :

A : End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist

B : End users will be immediately notified via a pop-up that their machine is in-network isolation

C : End-users receive a pop-up notification when a prevention action occurs

D : End users will receive a pop-up allowing them to confirm or refuse a pending quarantine

Answer: C

Question 4

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

Options :

A : Configure a Real Time Response policy allowlist with the specific IP addresses

B : Configure a Containment Policy with the specific IP addresses

C : Configure a Containment Policy with the entire internal IP CIDR block

D : Configure the Host firewall to allowlist the specific IP addresses

Answer: D

Question 5

Which statement is TRUE regarding disabling detections on a host?

Options :

A :

Hosts with detections disabled will not alert on blocklisted hashes or machine learning detections, but will still alert on IOA-based detections. It will remain that way until detections are enabled again

B :

Hosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

C :

Hosts cannot have their detections disabled individually

D :

Hosts with detections disabled will not alert on anything until detections are enabled again

Answer: B

Higher Test Marks with Free Online CCFA-200b Exam Practice

Buying Options: