You have been asked to troubleshoot why Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host. Which report can be used to determine if this is an issue with an old prevention polic

The correct answer is C. Prevention Policy Debug. The report that can be used to determine if Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host due to an old prevention policy is Prevention Policy Debug. The Prevention Policy Debug report allows you to view and compare the prevention policy settings applie

Prevention Policy Configuration

Question

You have been asked to troubleshoot why Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host. Which report can be used to determine if this is an issue with an old prevention policy?

Options

AHost Update Status Report
BCustom Alerting Audit Trail
CPrevention Policy Debug
DSBEM Debug Report

How the community answered

(22 responses)

A
5% (1)
B
14% (3)
C
77% (17)
D
5% (1)

Explanation

The report that can be used to determine if Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host due to an old prevention policy is Prevention Policy Debug. The Prevention Policy Debug report allows you to view and compare the prevention policy settings applied to each host in your environment. You can use this report to identify any hosts that have outdated or inconsistent prevention policy settings, such as SBEM, which is a feature that monitors and prevents malicious script execution on Windows systems.

Topics

#SBEM#Script Based Execution Monitoring#prevention policy#troubleshooting reports

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice