What happens to the data and alerts linked to a cloud account after it is deprovisioned from the Falcon console?

Question

Options

• AThe cloud account's data remains visible only if the account is re-registered within 7 days.
• BAll data and alerts associated with the account are immediately and permanently deleted.
• CData is archived for 30 days and then permanently deleted.
• DHistorical data and alerts remain accessible, but new data collection stops.

• A
  4% (2)
• B
  2% (1)
• C
  6% (3)
• D
  88% (42)

Explanation

Option A: Data visibility is not tied to re-registration within a specific timeframe. Historical data is retained regardless of whether the account is re-registered or permanently deprovisioned. This answer introduces an unnecessary restriction. Option B: CrowdStrike retains historical data for compliance and forensic purposes. Immediate and permanent deletion would hinder post-deprovisioning investigations or audits, which is not the intended behavior of the Falcon platform. Option C: There is no automatic data archival or deletion process tied to deprovisioning a cloud account in Falcon. Historical data remains accessible for an extended period, as determined by organizational data retention policies. Option D: When a cloud account is deprovisioned from Falcon, the platform stops collecting new data and generating alerts for the account. However, historical data and alerts are retained for compliance and auditing purposes. This ensures organizations can review past activity and investigate incidents even after the account is deprovisioned.

No community discussion yet for this question.