Question 1

When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Options :

A : Create a Dynamic Group with Type=Workstation Assignment

B : Create a Dynamic Group and Import All Workstations

C : Create a Static Group and Import all Workstations

D : Create a Static Group with Type=Workstation Assignment

Answer: A

Question 2

Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

Options :

A : TCP port 22 (SSH)

B : TCP port 443 (HTTPS)

C : TCP port 80 (HTTP)

D : TCP UDP port 53 (DNS)

Answer: B

Question 3

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?

Options :

A : Proxy information

B : NMAP scanning

C : TCP inspection

D : Deep packet inspection

Answer: D

Question 4

Which of the following uses Regex to create a detection or take a preventative action?

Options :

A : Machine Learning Exclusion

B : Custom IOA

C : Sensor Visibility Exclusion

D : Custom IOC

Answer: B

Question 5

When would the No Action option be assigned to a hash in IOC Management?

Options :

A : When you want to save the indicator for later action, but do not want to block or allow it at this time

B : Add the indicator to your allowlist and do not detect it

C : There is no such option as No Action available in the Falcon console

D : Add the indicator to your blocklist and show it as a detection

Answer: A

Free CCFA-200b Mock Exam – Practice Online Confidently

Buying Options: