Pass CrowdStrike CCFA-200 Exam With Practice Test Questions Dumps Bundle [Q20-Q37]

Rate this post

Pass CrowdStrike CCFA-200 Exam With Practice Test Questions Dumps Bundle

2023 Valid CCFA-200 test answers & CrowdStrike Exam PDF

QUESTION 20
What is the maximum number of patterns that can be added when creating a new exclusion?

QUESTION 21
You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

Prevention Policy Audit Trail

Prevention Policy Debug

Prevention Hashes Ignored

Machine-Learning Prevention Monitoring

QUESTION 22
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

Base URL

Secret

Client ID

Client name

QUESTION 23
How are user permissions set in Falcon?

Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

An administrator selects individual granular permissions from the Falcon Permissions List during user creation

Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions

Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments

QUESTION 24
How do you find a list of inactive sensors?

The Falcon platform does not provide reporting for inactive sensors

A sensor is always considered active until removed by an Administrator

Run the Inactive Sensor Report in the Host setup and management option

Run the Sensor Aging Report within the Investigate option

QUESTION 25
What are custom alerts based on?

Custom workflows

Custom event based triggers

Predefined alert templates

User defined Splunk queries

QUESTION 26
You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?

Detection slider: Extra Aggressive
Prevention slider: Cautious

Detection slider: Moderate
Prevention slider: Disabled

Detection slider: Cautious
Prevention slider: Cautious

Detection slider: Disabled
Prevention slider: Disabled

QUESTION 27
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

Edit the Default Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Edit the Default Response Policy and add the host group to the exceptions list under “Real Time Functionality”

Create a new Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Create a new Response Policy and add the host name to the exceptions list under “Real Time Functionality”

QUESTION 28
Which is a filter within the Host setup and management > Host management page?

User name

BIOS Version

Locality

QUESTION 29
Which role is required to manage groups and policies in Falcon?

Falcon Host Analyst

Falcon Host Administrator

Prevention Hashes Manager

Falcon Host Security Lead

QUESTION 30
Which of the following is TRUE of the Logon Activities Report?

Shows a graphical view of user logon activity and the hosts the user connected to

The report can be filtered by computer name

It gives a detailed list of all logon activity for users

It only gives a summary of the last logon activity for users

QUESTION 31
Even though you are a Falcon Administrator, you discover you are unable to use the “Connect to Host” feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

Real Time Responder

Endpoint Manager

Falcon Investigator

Remediation Manager

QUESTION 32
Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

TCP port 22 (SSH)

TCP port 443 (HTTPS)

TCP port 80 (HTTP)

TCP UDP port 53 (DNS)

QUESTION 33
What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

Microsoft updates

Notifications have been disabled on that host sensor

Falcon console updates are pending

Falcon sensors installing an update

QUESTION 34
Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

Remediation Manager

Real Time Responder – Read Only Analyst

Falcon Analyst – Read Only

Real Time Responder – Active Responder

QUESTION 35
When a host is placed in Network Containment, which of the following is TRUE?

The host machine is unable to send or receive network traffic outside of the local network

The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and traffic allowed in the Firewall Policy

The host machine is unable to send or receive any network traffic

The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy

QUESTION 36
Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

Sensor Report

Machine Learning Prevention Monitoring

Falcon UI Audit Trail

Machine Learning Debug

QUESTION 37
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20 minute default provisioning window?

ExtendedWindow=1

Timeout=0

ProvNoWait=1

Timeout=30

Loading …