A company wants to create a Falcon Sensor policy to enforce strict monitoring on critical servers. What is an essential configuration step for the policy?

The correct answer is A. Configure prevention settings such as "Exploit Mitigation" and "Malware Prevention" for the policy. Option A: Configuring prevention settings like "Exploit Mitigation" and "Malware Prevention" is critical to enhance security on servers. These settings help the Falcon Sensor proactively block threats and secure the system. Option B: The "Sensor Exclusions" tab is for excluding…

Endpoint and Workload Security Configuration

Question

Options

AConfigure prevention settings such as "Exploit Mitigation" and "Malware Prevention" for the policy.
BAdd the policy under the "Sensor Exclusions" tab in the Falcon Console.
CAssign the policy to the "Default Group" to ensure global coverage.
DSet the policy mode to "Detection Only" for all servers.

How the community answered

(31 responses)

A
87% (27)
B
3% (1)
C
6% (2)
D
3% (1)

Explanation

Option A: Configuring prevention settings like "Exploit Mitigation" and "Malware Prevention" is critical to enhance security on servers. These settings help the Falcon Sensor proactively block threats and secure the system. Option B: The "Sensor Exclusions" tab is for excluding specific files, paths, or processes from monitoring, not for creating or applying policies. Option C: Assigning to the "Default Group" might lead to unintended policy application across non-critical systems. Policies should target specific groups for better control. Option D: While "Detection Only" provides visibility, it does not actively prevent threats. For critical servers, enabling prevention is more appropriate to mitigate risks.

Topics

#Falcon Sensor policy#exploit mitigation#malware prevention#prevention settings

Community Discussion

No community discussion yet for this question.

Full CCCS-203B Practice