Question 1

You have a Windows host on your network in

Reduced functionality mode (RFM). While the

system is in RFM, which of the following is TRUE?

Options :

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventions

will not be triggered

Answer: D

Question 2

When the Notify End Users policy setting is turned on, which of the following is TRUE?

Options :

A : End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist

B : End users will be immediately notified via a pop-up that their machine is in-network isolation

C : End-users receive a pop-up notification when a prevention action occurs

D : End users will receive a pop-up allowing them to confirm or refuse a pending quarantine

Answer: C

Question 3

Which of the following would give you information about inactive sensors within the Falcon console?

Options :

A : Sensor Update Policies

B : Sensor Downloads

C : Sensor Coverage Lookup

D : Sensor Health

Answer: D

Question 4

What command should be run to verify if a Windows sensor is running?

Options :

A : regedit myfile.reg

B : sc query csagent

C : netstat -f

D : ps -ef | grep falcon

Answer: B

Question 5

Which of the following is TRUE regarding disabling detections for a host?

Options :

A : After disabling detections, the data for all existing detections prior to disabling detections is removed from the Event Search

B : After disabling detections, the host will operate in Reduced Functionality Mode (RFM) until detections are enabled

C : The DetectionSummaryEvent continues being sent to the Streaming API for that host

D : The detections for that host are removed from the console immediately. No new detections will display in the console going forward unless detections are enabled

Answer: D

Free CCFA-200b Mock Exam – Practice Online Confidently

Buying Options: