[Feb 17, 2023] Latest Questions CCFA-200 Guide to Prepare Free Practice Tests [Q14-Q38]

Rate this post

[Feb 17, 2023] Latest Questions CCFA-200 Guide to Prepare Free Practice Tests

Reliable CCFA-200 Dumps Questions Available as Web-Based Practice Test Engine

NO.14 Which is a filter within the Host setup and management > Host management page?

User name

BIOS Version

Locality

NO.15 Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

Remediation Manager

Real Time Responder – Read Only Analyst

Falcon Analyst – Read Only

Real Time Responder – Active Responder

NO.16 You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

Clone the workflow and replace the existing email with your CISO’s email

Add a sequential action to send a custom email to your CISO

Add a parallel action to send a custom email to your CISO

Add the CISO’s email to the existing action

NO.17 Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

Edit the Default Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Edit the Default Response Policy and add the host group to the exceptions list under “Real Time Functionality”

Create a new Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Create a new Response Policy and add the host name to the exceptions list under “Real Time Functionality”

NO.18 What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

Microsoft updates

Notifications have been disabled on that host sensor

Falcon console updates are pending

Falcon sensors installing an update

NO.19 You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

Specific sensor version number

Auto – TEST-QA

Sensor version updates off

Auto – N-1

NO.20 What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?

Endpoint ID (EID)

Agent ID (AID)

Security ID (SID)

Computer ID (CID)

NO.21 When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Create a Dynamic Group with Type=Workstation Assignment

Create a Dynamic Group and Import All Workstations

Create a Static Group and Import all Workstations

Create a Static Group with Type=Workstation Assignment

NO.22 Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

Sensor Report

Machine Learning Prevention Monitoring

Falcon UI Audit Trail

Machine Learning Debug

NO.23 What is the maximum number of patterns that can be added when creating a new exclusion?

NO.24 You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

A Sensor Update Policy was misconfigured

A host was offline for more than 24 hours

A patch was pushed overnight to all Windows systems

A host was placed in network containment from a detection

NO.25 Which of the following is NOT a way to determine the sensor version installed on a specific endpoint?

Use the Sensor Report to filter to the specific endpoint

Use Host Management to select the desired endpoint. The agent version will be listed in the columns and details

From a command line, run the sc query csagent -version command

Use the Investigate > Host Search to filter to the specific endpoint

NO.26 You need to export a list of all deletions for a specific Host Name in the last 24 hours. What is the best way to do this?

Go to Host Management in the Host page. Select the host and use the Export Detections button

Utilize the Detection Resolution Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the “Detection Resolution History” section

In the Investigate module, access the Detection Activity page. Use the filters to focus on the appropriate hostname and time, then export the results

Utilize the Detection Activity Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the “Detections by Host” section

NO.27 Where do you obtain the Windows sensor installer for CrowdStrike Falcon?

Sensors are downloaded from the Hosts > Sensor Downloads

Sensor installers are unique to each customer and must be obtained from support

Sensor installers are downloaded from the Support section of the CrowdStrike website

Sensor installers are not used because sensors are deployed from within Falcon

NO.28 What is the purpose of a containment policy?

To define which Falcon analysts can contain endpoints

To define the duration of Network Containment

To define the trigger under which a machine is put in Network Containment (e.g. a critical detection)

To define allowed IP addresses over which your hosts will communicate when contained

NO.29 In order to quarantine files on the host, what prevention policy settings must be enabled?

Malware Protection and Custom Execution Blocking must be enabled

Next-Gen Antivirus Prevention sliders and “Quarantine & Security Center Registration” must be enabled

Malware Protection and Windows Anti-Malware Execution Blocking must be enabled

Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled

NO.30 Which exclusion pattern will prevent detections on a file at C:Program FilesMy ProgramMy Filesprogram.exe?

Program FilesMy ProgramMy Files*

Program FilesMy Program*

*Program FilesMy Program*

NO.31 To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead

Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only

Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block

Using IOC management, import the list of hashes and IP addresses and set the action to No Action

NO.32 You want to create a detection-only policy. How do you set this up in your policy’s settings?

Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.

Select the “Detect-Only” template. Disable hash blocking and exclusions.

You can’t create a policy that detects but does not prevent. Use Custom IOA rules to detect.

Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.

NO.33 The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

SSL inspection should be configured to occur on all Falcon traffic

Some network configurations, such as deep packet inspection, interfere with certificate validation

HTTPS interception should be enabled to proceed with certificate validation

Common sources of interference with certificate pinning include protocol race conditions and resource contention

NO.34 When creating new IOCs in IOC management, which of the following fields must be configured?

Hash, Description, Filename

Hash, Action and Expiry Date

Filename, Severity and Expiry Date

Hash, Platform and Action

NO.35 How does the Unique Hosts Connecting to Countries Map help an administrator?

It highlights countries with known malware

It helps visualize global network communication

It identifies connections containing threats

It displays intrusions from foreign countries

NO.36 Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

Falcon NGAV relies on signature-based detections

Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy

The Detection sliders cannot be set to a value less aggressive than the Prevention sliders

Falcon NGAV is not a replacement for Windows Defender or other antivirus programs

NO.37 Which role will allow someone to manage quarantine files?

Falcon Security Lead

Detections Exceptions Manager

Falcon Analyst – Read Only

Endpoint Manager

NO.38 What must an admin do to reset a user’s password?

From User Management, open the account details for the affected user and select “Generate New Password”

From User Management, select “Reset Password” from the three dot menu for the affected user account

From User Management, select “Update Account” and manually create a new password for the affected user account

From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid

Loading …

CrowdStrike CCFA-200 Exam Syllabus Topics:

Topic	Details
Topic 1	Explain the differences between the visibility and hunting reports Explain what information is in the Falcon UI Audit Trail Report
Topic 2	Explain what Machine Learning is “on sensor” vs. “the cloud” Explain the impact of reduced functionality mode (RFM) and why it might be caused
Topic 3	Configure custom alerts to notify individuals about policies, detections and incidents Recall how long inactive sensors are retained to define your data backup plan
Topic 4	Perform root cause analysis related to system user issues Apply additional advanced options for images VDIs, tokens and tags
Topic 5	Allowlist network traffic so it can connect to contained hosts Explain the information shown in the remote logon activity report
Topic 6	Create a new user, delete a user and edit a user, etc Describe the capabilities and limitations of each RTR role
Topic 7	Determine which reports to use when reporting on information relating to a host Apply appropriate settings to successfully install a Falcon sensor on Windows, Linux and macOS
Topic 8	Resolve policy settings, permissions and threshold issues Apply basic sensor install requirements and installation processes
Topic 9	Explain what precedence does regarding prevention policies Determine roles required for access to features and functionality in the Falcon console

Correct and Up-to-date CrowdStrike CCFA-200 BrainDumps: https://www.troytecdumps.com/CCFA-200-troytec-exam-dumps.html

High-quality Troytec review files

[Feb 17, 2023] Latest Questions CCFA-200 Guide to Prepare Free Practice Tests [Q14-Q38]

CrowdStrike CCFA-200 Exam Syllabus Topics:

troytecdumps

Leave a Reply Cancel reply

CrowdStrike CCFA-200 Exam Syllabus Topics:

Related Posts

[Q62-Q77] Updated CCFA-200 Dumps PDF – CCFA-200 Real Valid Brain Dumps With 152 Questions!

Read Online CCFH-202 Test Practice Test Questions Exam Dumps [Q22-Q43]

troytecdumps

Leave a Reply Cancel reply