[Oct 13, 2023] CCFA-200 Exam Dumps - 100% Marks In CCFA-200 Exam!
Exam Dumps Use Real CrowdStrike Certified Falcon Administrator Dumps With 100 Questions!
NEW QUESTION # 44
Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?
- A. Custom IOA rules cannot be created for domains
- B. .*badguydomain.com.*
- C. \Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill
- D. badguydomain\.com.*
Answer: C
NEW QUESTION # 45
Where do you obtain the Windows sensor installer for CrowdStrike Falcon?
- A. Sensor installers are unique to each customer and must be obtained from support
- B. Sensors are downloaded from the Hosts > Sensor Downloads
- C. Sensor installers are downloaded from the Support section of the CrowdStrike website
- D. Sensor installers are not used because sensors are deployed from within Falcon
Answer: A
NEW QUESTION # 46
In order to quarantine files on the host, what prevention policy settings must be enabled?
- A. Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled
- B. Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled
- C. Malware Protection and Windows Anti-Malware Execution Blocking must be enabled
- D. Malware Protection and Custom Execution Blocking must be enabled
Answer: C
NEW QUESTION # 47
What can the Quarantine Manager role do?
- A. Manage and change prevention settings
- B. Manage roles and users
- C. Manage detection settings
- D. Manage quarantined files to release and download
Answer: D
NEW QUESTION # 48
When would the No Action option be assigned to a hash in IOC Management?
- A. Add the indicator to your blocklist and show it as a detection
- B. Add the indicator to your allowlist and do not detect it
- C. There is no such option as No Action available in the Falcon console
- D. When you want to save the indicator for later action, but do not want to block or allow it at this time
Answer: D
NEW QUESTION # 49
Once an exclusion is saved, what can be edited in the future?
- A. Only the options to "Detect/Block" and/or "File Extraction" can be changed
- B. All parts of the exclusion can be changed
- C. The exclusion pattern cannot be changed
- D. Only the selected groups and hosts to which the exclusion is applied can be changed
Answer: B
NEW QUESTION # 50
Under which scenario can Sensor Tags be assigned?
- A. While updating a sensor in the Falcon console
- B. While managing hosts in the Falcon console
- C. While triaging a detection
- D. While installing a sensor
Answer: B
NEW QUESTION # 51
You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?
- A. Prevention Policy Audit Trail
- B. Prevention Policy Debug
- C. Machine-Learning Prevention Monitoring
- D. Prevention Hashes Ignored
Answer: A
NEW QUESTION # 52
When a host is placed in Network Containment, which of the following is TRUE?
- A. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy
- B. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and traffic allowed in the Firewall Policy
- C. The host machine is unable to send or receive network traffic outside of the local network
- D. The host machine is unable to send or receive any network traffic
Answer: A
NEW QUESTION # 53
Which of the following best describes the Default Sensor Update policy?
- A. The Default Sensor Update policy is only used for testing sensor updates
- B. The Default Sensor Update policy is a "catch-all" policy
- C. The Default Sensor Update policy is disabled by default
- D. The Default Sensor Update policy does not have the "Uninstall and maintenance protection" feature
Answer: B
NEW QUESTION # 54
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.
- A. the logon type (e.g. interactive, service)
- B. all hosts the user logged into
- C. the account type for the user (e.g. Domain Administrator, Local User)
- D. the last time the user's password was set
Answer: D
NEW QUESTION # 55
Why is it important to know your company's event data retention limits in the Falcon platform?
- A. This is not necessary; you simply select "All Time" in your query to search all data
- B. You will not be able to search event data into the past beyond your retention period
- C. Your query will require you to specify the data pool associated with the date you wish to search
- D. Data such as process records are kept for a shorter time than event data
Answer: B
NEW QUESTION # 56
You need to export a list of all deletions for a specific Host Name in the last 24 hours. What is the best way to do this?
- A. Utilize the Detection Resolution Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detection Resolution History" section
- B. Go to Host Management in the Host page. Select the host and use the Export Detections button
- C. Utilize the Detection Activity Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detections by Host" section
- D. In the Investigate module, access the Detection Activity page. Use the filters to focus on the appropriate hostname and time, then export the results
Answer: D
NEW QUESTION # 57
Which of the following is NOT an available filter on the Hosts Management page?
- A. Hostname
- B. Username
- C. OS Version
- D. Group
Answer: C
NEW QUESTION # 58
Which role is required to manage groups and policies in Falcon?
- A. Falcon Host Security Lead
- B. Prevention Hashes Manager
- C. Falcon Host Analyst
- D. Falcon Host Administrator
Answer: D
NEW QUESTION # 59
Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?
- A. Next-Gen Antivirus (NGAV) protection
- B. Real-time offline protection
- C. Identification and analysis of unknown executables
- D. Adware and Potentially Unwanted Program detection and prevention
Answer: C
NEW QUESTION # 60
If a user wanted to install an older version of the Falcon sensor, how would they find the older installer file?
- A. By emailing CrowdStrike support at [email protected]
- B. Older versions of the sensor are not available for download
- C. By installing the current sensor and clicking the "downgrade" button during the install
- D. By clicking on "Older versions" links under the Host setup and management > Deploy > Sensor downloads
Answer: D
NEW QUESTION # 61
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?
- A. Sensor version set to N-2 and Bulk maintenance mode is turned on
- B. Sensor version fixed and Uninstall and maintenance protection turned on
- C. Sensor version set to N-1 and Bulk maintenance mode is turned on
- D. Sensor version updates off and Uninstall and maintenance protection turned off
Answer: B
NEW QUESTION # 62
You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?
- A. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"
- B. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.
- C. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
- D. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"
Answer: B
NEW QUESTION # 63
What are custom alerts based on?
- A. Predefined alert templates
- B. User defined Splunk queries
- C. Custom event based triggers
- D. Custom workflows
Answer: C
NEW QUESTION # 64
What is the primary purpose of using glob syntax in an exclusion?
- A. To specify a Domain be excluded from detections
- B. To specify a network share be excluded from detections
- C. To specify exclusion patterns to easily add files and folders and extensions to be prevented
- D. To specify exclusion patterns to easily exclude files and folders and extensions from detections
Answer: D
NEW QUESTION # 65
Where can you modify settings to permit certain traffic during a containment period?
- A. Containment Policy
- B. Host Settings
- C. Prevention Policy
- D. Firewall Settings
Answer: A
NEW QUESTION # 66
Which of the following is NOT an available filter on the Hosts Management page?
- A. OS Version
- B. Hostname
- C. Username
- D. Group
Answer: C
NEW QUESTION # 67
An analyst is asked to retrieve an API client secret from a previously generated key. How can they achieve this?
- A. The API client secret can be viewed from the Edit API client pop-up box
- B. Enable the Client Secret column to reveal the API client secret
- C. The API client secret cannot be retrieved after it has been created
- D. Re-create the API client using the exact name to see the API client secret
Answer: B
NEW QUESTION # 68
......
Pass Your CCFA-200 Exam Easily With 100% Exam Passing Guarantee: https://examdumps.passcollection.com/CCFA-200-valid-vce-dumps.html
