Free CCFA – Crowdstrike CCFA Practice Test Question

Select an option, then click Submit answer.

• ○ Contact support and request that they modify the Machine Learning settings to no longer include this detection
• ○ Using IOC Management, add the hash of the binary in question and set the action to "Allow"
• ○ Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
• ○ Using IOC Management, add the hash of the binary in question and set the action to "No Action"

Select an option, then click Submit answer.

• ○ Custom IOA Rule Groups
• ○ Custom IOC Groups
• ○ Enterprise Groups
• ○ Operating System Groups

Select an option, then click Submit answer.

• ○ Create a group containing the desired hosts using "Static Assignment." Go to the Assigned Host Groups tab of the desired policy and dick "Add groups to policy." Select the desired Group(s).
• ○ Assign a tag to the desired hosts in Host Management. Create a group with an assignment rule based on that tag. Go to the Assignment tab of the desired policy and click "Add Groups to Policy." Select the desired Group(s).
• ○ Create a group containing the desired hosts using "Dynamic Assignment." Go to the Assigned Host Groups tab of the desired policy and select criteria such as OU, OS, Hostname pattern, etc.
• ○ On the Assignment tab of the desired policy, select "Static" assignment. From the next window, select the desired hosts (using fitters if needed) and click Add.

Select an option, then click Submit answer.

• ○ The API client secret can be viewed from the Edit API client pop-up box
• ○ Enable the Client Secret column to reveal the API client secret
• ○ Re-create the API client using the exact name to see the API client secret
• ○ The API client secret cannot be retrieved after it has been created

Select an option, then click Submit answer.

• ○ \Program Files\My Program\My Files\*
• ○ \Program Files\My Program\*
• ○ *\*
• ○ *\Program Files\My Program\*\

Select an option, then click Submit answer.

• ○ Precedence applies to the Prevention policy and not to the Sensor Update policy
• ○ Hosts assigned to multiple policies will assume the highest ranked policy in the list (policy with the lowest number)
• ○ Hosts assigned to multiple policies will assume the lowest ranked policy in the list (policy with the highest number)
• ○ Precedence ensures that conflicting policy settings are not set in the same policy

Select an option, then click Submit answer.

• ○ By ensuring each user has set the "pop-ups allowed" in their User Profile configuration page
• ○ By enabling "Upload quarantined files" in the General Settings configuration page
• ○ By turning on the "Notify End Users" setting at the top of the Prevention policy details configuration page
• ○ By selecting "Enable pop-up messages" from the User configuration page

Select an option, then click Submit answer.

• ○ Endpoint ID (EID)
• ○ Agent ID (AID)
• ○ Security ID (SID)
• ○ Computer ID (CID)

Select an option, then click Submit answer.

• ○ Custom Alert History
• ○ Workflow Execution log
• ○ Workflow Audit log
• ○ Falcon UI Audit Trail

Select an option, then click Submit answer.

• ○ To specify a Domain be excluded from detections
• ○ To specify exclusion patterns to easily exclude files and folders and extensions from detections
• ○ To specify exclusion patterns to easily add files and folders and extensions to be prevented
• ○ To specify a network share be excluded from detections

Select an option, then click Submit answer.

• ○ Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions
• ○ Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments
• ○ An administrator selects individual granular permissions from the Falcon Permissions List during user creation
• ○ Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

Select an option, then click Submit answer.

• ○ System monitoring will be unavailable
• ○ Event reporting will be unavailable
• ○ Prevention patterns will not be triggered
• ○ Some detection patterns and preventions will not be triggered

Select an option, then click Submit answer.

• ○ a bar chart where a bar represents a daily count of remote connections
• ○ a geographical chart showing the geo-location of remote IP address
• ○ a graph showing connections between hosts and users
• ○ a pie chart showing a count per remote logon type

Select an option, then click Submit answer.

• ○ Prevents the sensor from entering Reduced Functionality Mode
• ○ Prevents unauthorized uninstallation of the sensor
• ○ Prevents automatic updates of the sensor
• ○ Prevents modification of sensor update policy

Select an option, then click Submit answer.

• ○ The "Servers" group already has a policy applied to it
• ○ The "Servers" group must be disabled first
• ○ The new prevention policy should be enabled first
• ○ Host type was not defined correctly within the prevention policy

Select an option, then click Submit answer.

• ○ Preventions will be disabled for the host
• ○ You cannot disable detections for a host
• ○ The detections for the host are removed from the console immediately and no new detections will display in the console going forward
• ○ Existing detections for the host remain, but no new detections will display in the console going forward

Select an option, then click Submit answer.

• ○ Status
• ○ Platform
• ○ Hostname
• ○ Type

Select an option, then click Submit answer.

• ○ Enables custom detections for the host
• ○ New detections will start appearing in the console, and all retroactive stored detections will be restored to the console for that host
• ○ New detections will start appearing in the console immediately. Previous detections will not be restored to the console for that host
• ○ Preventions will be enabled for the host

Select an option, then click Submit answer.

• ○ Auto N-2 policy
• ○ They don’t get a policy
• ○ The default policy
• ○ Auto N-1 policy

Select an option, then click Submit answer.

• ○ A list of all logons for all users
• ○ A list of last endpoints that a user logged in to
• ○ A list of users who are remotely logged on to devices based on local IP and local port
• ○ A list of unique users who are remotely logged on to devices based on the country

Select an option, then click Submit answer.

• ○ Falcon Administrator, Falcon Security Lead
• ○ Falcon Administrator, Workflow Author
• ○ Falcon Administrator, Falcon Security Lead, Workflow Author
• ○ Falcon Administrator, Workflow Author, Falcon Security Lead, Falcon Investigator

Select an option, then click Submit answer.

• ○ Detections Exception Manager
• ○ Remediation Manager
• ○ Endpoint Manager
• ○ Quarantine Manager

Select an option, then click Submit answer.

• ○ ProvNoWait=1
• ○ /quiet
• ○ VM=True
• ○ NO_START=1

Select an option, then click Submit answer.

• ○ Containment policy
• ○ General settings
• ○ Host group
• ○ Response policies