Study HIGH Quality CCFA-200 Free Study Guides and Exams Tutorials [Q40-Q61] – IT Certification Exam Questions & Answers

Rate this post

Study HIGH Quality CCFA-200 Free Study Guides and Exams Tutorials

Download CrowdStrike CCFA-200 Exam Dumps to Pass Exam Easily

NEW QUESTION 40
Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?

.*badguydomain.com.*

DeviceHarddiskVolume2*.exe -SingleArgument www.badguydomain.com /kill

badguydomain.com.*

Custom IOA rules cannot be created for domains

NEW QUESTION 41
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?

Contact support and request that they modify the Machine Learning settings to no longer include this detection

Using IOC Management, add the hash of the binary in question and set the action to “Allow”

Using IOC Management, add the hash of the binary in question and set the action to “Block, hide detection”

Using IOC Management, add the hash of the binary in question and set the action to “No Action”

NEW QUESTION 42
How do you assign a Prevention policy to one or more hosts?

Create a new policy and assign it directly to those hosts on the Host Management page

Modify the users roles on the User Management page

Ensure the hosts are in a group and assign that group to a custom Prevention policy

Create a new policy and assign it directly to those hosts on the Prevention policy page

NEW QUESTION 43
How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

Under Dashboards and reports, choose the Sensor Report. Set the “Last Seen” dropdown to 30 days and reference the Inactive Sensors widget

Under Host setup and management, choose the Host Management page. Set the group filter to “Inactive Sensors”

Under Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days

Under Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

NEW QUESTION 44
What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?

Endpoint ID (EID)

Agent ID (AID)

Security ID (SID)

Computer ID (CID)

NEW QUESTION 45
How do you find a list of inactive sensors?

The Falcon platform does not provide reporting for inactive sensors

A sensor is always considered active until removed by an Administrator

Run the Inactive Sensor Report in the Host setup and management option

Run the Sensor Aging Report within the Investigate option

NEW QUESTION 46
You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?

Detection slider: Extra Aggressive
Prevention slider: Cautious

Detection slider: Moderate
Prevention slider: Disabled

Detection slider: Cautious
Prevention slider: Cautious

Detection slider: Disabled
Prevention slider: Disabled

NEW QUESTION 47
How are user permissions set in Falcon?

Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

An administrator selects individual granular permissions from the Falcon Permissions List during user creation

Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions

Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments

NEW QUESTION 48
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

Clone the workflow and replace the existing email with your CISO’s email

Add a sequential action to send a custom email to your CISO

Add a parallel action to send a custom email to your CISO

Add the CISO’s email to the existing action

NEW QUESTION 49
With Custom Alerts, it is possible to __________.

schedule the alert to run at any interval

receive an alert in an email

configure prevention actions for alerting

be alerted to activity in real-time

NEW QUESTION 50
What are custom alerts based on?

Custom workflows

Custom event based triggers

Predefined alert templates

User defined Splunk queries

NEW QUESTION 51
Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

Falcon NGAV relies on signature-based detections

Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy

The Detection sliders cannot be set to a value less aggressive than the Prevention sliders

Falcon NGAV is not a replacement for Windows Defender or other antivirus programs

NEW QUESTION 52
When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Create a Dynamic Group with Type=Workstation Assignment

Create a Dynamic Group and Import All Workstations

Create a Static Group and Import all Workstations

Create a Static Group with Type=Workstation Assignment

NEW QUESTION 53
What is the goal of a Network Containment Policy?

Increase the aggressiveness of the assigned prevention policy

Limit the impact of a compromised host on the network

Gain more visibility into network activities

Partition a network for privacy

NEW QUESTION 54
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

Real Time Responder – Administrator

Real Time Responder – Read Only Analyst

Real Time Responder – Script Developer

Real Time Responder – Active Responder

NEW QUESTION 55
Once an exclusion is saved, what can be edited in the future?

All parts of the exclusion can be changed

Only the selected groups and hosts to which the exclusion is applied can be changed

Only the options to “Detect/Block” and/or “File Extraction” can be changed

The exclusion pattern cannot be changed

NEW QUESTION 56
When uninstalling a sensor, which of the following is required if the ‘Uninstall and maintenance protection’ setting is enabled within the Sensor Update Policies?

Maintenance token

Customer ID (CID)

Bulk update key

Agent ID (AID)

NEW QUESTION 57
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.

the account type for the user (e.g. Domain Administrator, Local User)

all hosts the user logged into

the logon type (e.g. interactive, service)

the last time the user’s password was set

NEW QUESTION 58
Which of the following best describes the Default Sensor Update policy?

The Default Sensor Update policy does not have the “Uninstall and maintenance protection” feature

The Default Sensor Update policy is only used for testing sensor updates

The Default Sensor Update policy is a “catch-all” policy

The Default Sensor Update policy is disabled by default

NEW QUESTION 59
Where do you obtain the Windows sensor installer for CrowdStrike Falcon?

Sensors are downloaded from the Hosts > Sensor Downloads

Sensor installers are unique to each customer and must be obtained from support

Sensor installers are downloaded from the Support section of the CrowdStrike website

Sensor installers are not used because sensors are deployed from within Falcon

NEW QUESTION 60
What is the maximum number of patterns that can be added when creating a new exclusion?

NEW QUESTION 61
Which is a filter within the Host setup and management > Host management page?

User name

BIOS Version

Locality

Loading …

Get 100% Real Free CrowdStrike Certified Falcon Administrator CCFA-200 Sample Questions: https://www.it-tests.com/CCFA-200.html

Tags: CCFA-200 exam questions answers, CCFA-200 latest exam certification cost, CCFA-200 new dumps free download, CCFA-200 new test camp sheet, CCFA-200 reliable exam simulator online, CCFA-200 reliable test pdf, CCFA-200 valid test simulator free, new CCFA-200 exam syllabus

IT Certification Exam Questions & Answers

Leave a Reply Cancel reply