A security administrator needs to edit an existing Falcon Sensor policy to reduce the potential for false positives. What action is required to achieve this?

The correct answer is C. Lower the sensitivity of "Exploit Detection" to avoid triggering false alerts. Option A: Excluding all system processes creates a significant security risk and is not an effective way to manage false positives. Option B: Editing the existing policy is sufficient and does not require deletion. Recreating policies unnecessarily increases administrative…

Sensor Deployment and Management

Question

Options

AAdd an exclusion rule for all system processes to prevent unnecessary alerts.
BDelete the existing policy and recreate it with the updated configuration.
CLower the sensitivity of "Exploit Detection" to avoid triggering false alerts.
DMove the policy to the bottom of the policy priority list in the Falcon Console.

How the community answered

(19 responses)

A
16% (3)
B
5% (1)
C
74% (14)
D
5% (1)

Explanation

Option A: Excluding all system processes creates a significant security risk and is not an effective way to manage false positives. Option B: Editing the existing policy is sufficient and does not require deletion. Recreating policies unnecessarily increases administrative overhead. Option C: Lowering the sensitivity of "Exploit Detection" can help reduce false positives by adjusting the thresholds for detecting potential threats. This action retains proactive protection while improving alert accuracy. Option D: Policy priority affects which policy is applied when multiple policies overlap but does not address false positives within a policy.

Topics

#Falcon Sensor policy#false positive reduction#exploit detection sensitivity#policy tuning

Community Discussion

No community discussion yet for this question.

Full CCCS-203B Practice