CCFA-200B Exam Questions

What command should be run to verify if a Windows sensor is running?

Which option allows you to exclude behavioral detections from the detections page?

What are custom alerts based on?

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

Which of the following is TRUE of the Logon Activities Report?

Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

An analyst is asked to retrieve an API client secret from a previously generated key. How can they achieve this?

Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

On which page of the Falcon console would you create sensor groups?

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration...

Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

What impact does disabling detections on a host have on an API?

Under which scenario can Sensor Tags be assigned?

Custom IOA rules are defined using which syntax?

With Custom Alerts, it is possible to __________.

How do you assign a Prevention policy to one or more hosts?

You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they...

Which exclusion pattern will prevent detections on a file at C:\Program Files\My Program\My Files\program.exe?

When a host is placed in Network Containment, which of the following is TRUE?

When would the No Action option be assigned to a hash in IOC Management?

In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor U...

Once an exclusion is saved, what can be edited in the future?

Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?

How do you find a list of inactive sensors?

Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

Why is the ability to disable detections helpful?

The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.

An analyst has reported they are not receiving workflow triggered notifications in the past few days. Where should you first check for potential failures?

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customi...

Which of the following is NOT an available filter on the Hosts Management page?

What is the primary purpose of using glob syntax in an exclusion?

How are user permissions set in Falcon?

Which of the following is NOT a way to determine the sensor version installed on a specific endpoint?

Which is the correct order for manually installing a Falcon Package on a macOS system?

You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Pr...

How does the Unique Hosts Connecting to Countries Map help an administrator?

On a Windows host, what is the best command to determine if the sensor is currently running?

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

Which is a filter within the Host setup and management > Host management page?

When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

When the Notify End Users policy setting is turned on, which of the following is TRUE?

If a user wanted to install an older version of the Falcon sensor, how would they find the older installer file?

Which of the following best describes the Default Sensor Update policy?

Under the "Next-Gen Antivirus: Cloud Machine Learning" setting there are two categories, one of them is "Cloud Anti-Malware" and the other is:

You have created a Sensor Update Policy for the Mac platform. Which other operating system(s) will this policy manage?

Which of the following Machine Learning (ML) sliders will only detect or prevent high confidence malicious items?