Question 1

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

Options :

A : Configure a Real Time Response policy allowlist with the specific IP addresses

B : Configure a Containment Policy with the specific IP addresses

C : Configure a Containment Policy with the entire internal IP CIDR block

D : Configure the Host firewall to allowlist the specific IP addresses

Answer: D

Question 2

How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

Options :

A : By ensuring each user has set the 'pop-ups allowed' in their User Profile configuration page

B : By enabling 'Upload quarantined files' in the General Settings configuration page

C : By turning on the 'Notify End Users' setting at the top of the Prevention policy details configuration page

D : By selecting 'Enable pop-up messages' from the User configuration page

Answer: C

Question 3

What command should be run to verify if a Windows sensor is running?

Options :

A : regedit myfile.reg

B : sc query csagent

C : netstat -f

D : ps -ef | grep falcon

Answer: B

Question 4

Which of the following is TRUE regarding disabling detections for a host?

Options :

A : After disabling detections, the data for all existing detections prior to disabling detections is removed from the Event Search

B : After disabling detections, the host will operate in Reduced Functionality Mode (RFM) until detections are enabled

C : The DetectionSummaryEvent continues being sent to the Streaming API for that host

D : The detections for that host are removed from the console immediately. No new detections will display in the console going forward unless detections are enabled

Answer: D

Question 5

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

Options :

A : Base URL

B : Secret

C : Client ID

D : Client name

Answer: B

Free CCFA-200b Mock Exam – Practice Online Confidently

Buying Options: