Question 1

What are custom alerts based on?

Options :

A : Custom workflows

B : Custom event based triggers

C : Predefined alert templates

D : User defined Splunk queries

Answer: B

Question 2

Which of the following can a Falcon Administrator edit in an existing user's profile?

Options :

A : First or Last name

B : Phone number

C : Email address

D : Working groups

Answer: D

Question 3

An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

Options :

A : File exclusions are not aligned to groups or hosts

B : There is a limit of three groups of hosts applied to any exclusion

C : There is no limit and exclusions can be applied to any or all groups

D : Each exclusion can be aligned to only one group of hosts

Answer: B

Question 4

Which statement is TRUE regarding disabling detections on a host?

Options :

A : Hosts with detections disabled will not alert on blocklisted hashes or machine learning detections, but will still alert on IOA-based detections. It will remain that way until detections are enabled again

B : Hosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

C : Hosts cannot have their detections disabled individually

D : Hosts with detections disabled will not alert on anything until detections are enabled again

Answer: B

Question 5

Which of the following uses Regex to create a detection or take a preventative action?

Options :

A : Machine Learning Exclusion

B : Custom IOA

C : Sensor Visibility Exclusion

D : Custom IOC

Answer: B

Free CCFA-200b Mock Exam – Practice Online Confidently

Buying Options: