Question 1

Which Real-Time response (RTR) role is automatically assigned to the falcon administrator ?

Options :

A :

No RTR roles are automatically assigned to the Falcon administrator

B : Administrator

C : Read only analyst

D : Active Responder

Answer: A

Question 2

Which statement is TRUE regarding disabling detections on a host?

Options :

A :

Hosts with detections disabled will not alert on blocklisted hashes or machine learning detections, but will still alert on IOA-based detections. It will remain that way until detections are enabled again

B :

Hosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

C :

Hosts cannot have their detections disabled individually

D :

Hosts with detections disabled will not alert on anything until detections are enabled again

Answer: B

Question 3

Which role is required to manage groups and policies in Falcon?

Options :

A : Falcon Host Analyst

B : Falcon Host Administrator

C : Prevention Hashes Manager

D : Falcon Host Security Lead

Answer: B

Question 4

Which role allows a user to connect to hosts using Real-Time Response?

Options :

A : Endpoint Manager

B : Falcon Administrator

C : Real Time Responder -- Active Responder

D : Prevention Hashes Manager

Answer: C

Question 5

When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Options :

A : Create a Dynamic Group with Type=Workstation Assignment

B : Create a Dynamic Group and Import All Workstations

C : Create a Static Group and Import all Workstations

D : Create a Static Group with Type=Workstation Assignment

Answer: A

Higher Test Marks with Free Online CCFA-200b Exam Practice

Buying Options: