Free CCFA-200 – CrowdStrike Certified Falcon Administrator Practice Test Question

Select an option, then click Submit answer.

• ○

  Endpoints with detections disabled will not alert on anything until detections are enabled again

• ○

  Endpoints cannot have their detections disabled individually

• ○

  DetectionSummaryEvent stops sending to the Streaming API for that host

• ○

  Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

Select an option, then click Submit answer.

• ○

  Detection events are kept for 90 days

• ○

  Detections events are kept for your subscribed data retention period

• ○

  Detection events are kept for 7 days

• ○

  Detection events are kept for 30 days

Select an option, then click Submit answer.

• ○

  SSL inspection should be configured to occur on all Falcon traffic

• ○

  Some network configurations, such as deep packet inspection, interfere with certificate validation

• ○

  HTTPS interception should be enabled to proceed with certificate validation

• ○

  Common sources of interference with certificate pinning include protocol race conditions and resource contention

Select an option, then click Submit answer.

• ○

  The API client secret can be viewed from the Edit API client pop-up box

• ○

  Enable the Client Secret column to reveal the API client secret

• ○

  Re-create the API client using the exact name to see the API client secret

• ○

  The API client secret cannot be retrieved after it has been created

Select an option, then click Submit answer.

• ○

  Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group

• ○

  Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"

• ○

  Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group

• ○

  Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"

Select an option, then click Submit answer.

• ○

  All parts of the exclusion can be changed

• ○

  Only the selected groups and hosts to which the exclusion is applied can be changed

• ○

  Only the options to "Detect/Block" and/or "File Extraction" can be changed

• ○

  The exclusion pattern cannot be changed

Select an option, then click Submit answer.

• ○

  It highlights countries with known malware

• ○

  It helps visualize global network communication

• ○

  It identifies connections containing threats

• ○

  It displays intrusions from foreign countries

Select an option, then click Submit answer.

• ○

  TCP port 22 (SSH)

• ○

  TCP port 443 (HTTPS)

• ○

  TCP port 80 (HTTP)

• ○

  TCP UDP port 53 (DNS)

Select an option, then click Submit answer.

• ○

  Older versions of the sensor are not available for download

• ○

  By emailing CrowdStrike support at support@crowdstrike.com

• ○

  By installing the current sensor and clicking the "downgrade" button during the install

• ○

  By clicking on "Older versions" links under the Host setup and management > Deploy > Sensor downloads

Select an option, then click Submit answer.

• ○

  Malware Protection and Custom Execution Blocking must be enabled

• ○

  Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled

• ○

  Malware Protection and Windows Anti-Malware Execution Blocking must be enabled

• ○

  Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled