Question 1

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?

Options :

A : Proxy information

B : NMAP scanning

C : TCP inspection

D : Deep packet inspection

Answer: D

Question 2

When the Notify End Users policy setting is turned on, which of the following is TRUE?

Options :

A : End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist

B : End users will be immediately notified via a pop-up that their machine is in-network isolation

C : End-users receive a pop-up notification when a prevention action occurs

D : End users will receive a pop-up allowing them to confirm or refuse a pending quarantine

Answer: C

Question 3

When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Options :

A : Create a Dynamic Group with Type=Workstation Assignment

B : Create a Dynamic Group and Import All Workstations

C : Create a Static Group and Import all Workstations

D : Create a Static Group with Type=Workstation Assignment

Answer: A

Question 4

You have a Windows host on your network in

Reduced functionality mode (RFM). While the

system is in RFM, which of the following is TRUE?

Options :

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventions

will not be triggered

Answer: D

Question 5

What command should be run to verify if a Windows sensor is running?

Options :

A : regedit myfile.reg

B : sc query csagent

C : netstat -f

D : ps -ef | grep falcon

Answer: B

Higher Test Marks with Free Online CCFA-200b Exam Practice

Buying Options: