QUESTION 20
What is the maximum number of patterns that can be added when creating a new exclusion?

QUESTION 21
You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

QUESTION 22
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

QUESTION 23
How are user permissions set in Falcon?

QUESTION 24
How do you find a list of inactive sensors?

QUESTION 25
What are custom alerts based on?

QUESTION 26
You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?

QUESTION 27
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

QUESTION 28
Which is a filter within the Host setup and management > Host management page?

QUESTION 29
Which role is required to manage groups and policies in Falcon?

QUESTION 30
Which of the following is TRUE of the Logon Activities Report?

QUESTION 31
Even though you are a Falcon Administrator, you discover you are unable to use the “Connect to Host” feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

QUESTION 32
Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

QUESTION 33
What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

QUESTION 34
Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

QUESTION 35
When a host is placed in Network Containment, which of the following is TRUE?

QUESTION 36
Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

QUESTION 37
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20 minute default provisioning window?