Question 1

When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

Options :

A : Custom IOA Rule Groups

B : Custom IOC Groups

C : Enterprise Groups

D : Operating System Groups

Answer: D

Question 2

Which of the following would give you information about inactive sensors within the Falcon console?

Options :

A : Sensor Update Policies

B : Sensor Downloads

C : Sensor Coverage Lookup

D : Sensor Health

Answer: D

Question 3

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

Options :

A : Base URL

B : Secret

C : Client ID

D : Client name

Answer: B

Question 4

Which of the following is TRUE regarding disabling detections for a host?

Options :

A :

After disabling detections, the data for all existing detections prior to disabling detections is removed from the Event Search

B :

After disabling detections, the host will operate in Reduced Functionality Mode (RFM) until detections are enabled

C :

The DetectionSummaryEvent continues being sent to the Streaming API for that host

D :

The detections for that host are removed from the console immediately. No new detections will display in the console going forward unless detections are enabled

Answer: D

Question 5

Which of the following uses Regex to create a detection or take a preventative action?

Options :

A : Machine Learning Exclusion

B : Custom IOA

C : Sensor Visibility Exclusion

D : Custom IOC

Answer: B

Free CCFA-200b Mock Exam – Practice Online Confidently

Buying Options: