CCFA-200B Exam Questions
252 real CCFA-200B exam questions with expert-verified answers and explanations. Page 3 of 6.
- Question #101Prevention Policies and Exclusions
What is the function of a single asterisk (*) in an ML exclusion pattern?
ML exclusionswildcard patternsexclusion syntaxglob patterns - Question #102IOC Management and Detection Tuning
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a...
IOC managementfalse positiveshash allowlistML detections - Question #103Response and Containment
What is the purpose of a containment policy?
network containmentcontainment policyIP allowlisthost isolation - Question #104Prevention Policies and Exclusions
An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?
exclusionshost groupspolicy scopeconfiguration limits - Question #105User and Role Management
Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host. W...
Real Time ResponseRBACuser rolesConnect to Host - Question #106User and Role Management
What must an admin do to reset a user's password?
user managementpassword resetadmin operationsaccount management - Question #107Response Policies and Configuration
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host...
Response PolicyRTRhost groupspolicy assignment - Question #108IOC Management and Detection Tuning
When creating new IOCs in IOC management, which of the following fields must be configured?
IOC managementrequired fieldsindicators of compromiseplatform configuration - Question #109User and Role Management
Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the ho...
RBACRTR rolesleast privilegeread-only analyst - Question #110Prevention Policies and Exclusions
One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is...
ML exclusionsfalse positivesfile path exclusionprevention tuning - Question #111Investigate and Event Search
Why is it important to know your company's event data retention limits in the Falcon platform?
data retentionevent searchquery limitationsFalcon platform - Question #112Sensor Management and Policies
What is the purpose of precedence with respect to the Sensor Update policy?
sensor update policypolicy precedencehost groupspolicy ranking - Question #113Sensor Deployment and Management
When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?
sensor uninstallmaintenance tokenmaintenance protectionsensor update policy - Question #114Prevention Policies and Exclusions
How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?
prevention policyend-user notificationquarantine alertspolicy configuration - Question #115Falcon Platform Overview and Navigation
Where in the Falcon console can information about supported operating system versions be found?
Falcon console navigationsupport moduleOS compatibilityplatform resources - Question #116Sensor Deployment and Management
What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?
Agent IDAIDsensor identificationhost management - Question #117Sensor Deployment and Management
Which of the following is a valid step when troubleshooting sensor installation failure?
sensor installationtroubleshootingservice requirementsdeployment validation - Question #118Detection Management and Investigation
You need to export a list of all deletions for a specific Host Name in the last 24 hours. What is the best way to do this?
detection activityinvestigationevent exporthostname filtering - Question #119User and Role Management
Which role will allow someone to manage quarantine files?
quarantine managementRBACFalcon rolesfile management - Question #120Prevention Policies and Exclusions
What is the maximum number of patterns that can be added when creating a new exclusion?
exclusion patternspattern limitsML exclusionsconfiguration constraints - Question #121Prevention Policies and Configuration
You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggres...
Machine Learning PreventionPrevention PolicyAudit ReportsDetection Slider - Question #122Host Management
How do you disable all detections for a host?
Host ManagementDetection SettingsHost Configuration - Question #123IOC Management
To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?
IOC ManagementCustom IOA RulesDomain BlockingIP Blocking - Question #124User Management and Roles
Which role is required to manage groups and policies in Falcon?
Role-Based Access ControlFalcon RolesPolicy ManagementGroup Management - Question #125User Management and Roles
Which of the following can a Falcon Administrator edit in an existing user's profile?
User ManagementFalcon AdministratorUser Profile Editing - Question #126Sensor Management
You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, w...
Sensor Update PolicySensor Version ManagementManual Version Control - Question #127Host Management
What is the goal of a Network Containment Policy?
Network ContainmentHost IsolationContainment Policy - Question #128Prevention Policies and Configuration
Which of the following applies to Custom Blocking Prevention Policy settings?
Custom BlockingPrevention HashesHash BlocklistPrevention Policy - Question #129Sensor Management
How many "Auto" sensor version update options are available for Windows Sensor Update Policies?
Sensor Update PolicyAuto Update OptionsWindows Sensor - Question #130Prevention Policies and Configuration
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?
Prevention PolicyHost GroupsPolicy Alignment - Question #131Detections and Investigations
How long are detection events kept in Falcon?
Detection EventsData RetentionEvent Storage - Question #132Visibility and Reporting
What information is provided in Logan Activities under Visibility Reports?
Logon ActivitiesVisibility ReportsUser Activity Monitoring - Question #133User Management and Roles
What can the Quarantine Manager role do?
Role-Based Access ControlQuarantine ManagerQuarantined Files - Question #134Host Management
On the Host management page which filter could be used to quickly identify all devices categorized as a "Workstation" by the Falcon Platform?
Host ManagementHost FilteringDevice TypeWorkstation - Question #135Host Management
Where in the console can you find a list of all hosts in your environment that are in Reduced Functionality Mode (RFM)?
Reduced Functionality ModeRFMHost ManagementHost Filtering - Question #136Host Management
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
Inactive HostsHost LifecycleAutomatic RemovalData Retention - Question #137Exclusions Management
When editing an existing IOA exclusion, what can NOT be edited?
IOA ExclusionsExclusion ManagementImmutable Fields - Question #138Exclusions Management
Which of the follow should be used with extreme caution because it may introduce additional security risks such as malware or other attacks which would not be recorded, detected, o...
IOA ExclusionsSecurity RiskExclusion TypesUnmonitored Activity - Question #139API Management
Which of the following is NOT an available action for an API Client?
API Client ManagementAPI ActionsAPI Security - Question #140API Management
How can a API client secret be viewed after it has been created?
API Client SecretAPI SecurityCredential Management - Question #141Sensor Deployment and Management
What will happen to a host if it is not assigned a Sensor Update policy?
Sensor Update policydefault policyhost assignmentpolicy fallback - Question #142Sensor Deployment and Management
Which statement describes what is recommended for the Default Sensor Update policy?
Sensor Update policydefault policybest practicespolicy configuration - Question #143Sensor Deployment and Management
Where do you obtain the Windows sensor installer for CrowdStrike Falcon?
sensor installationsensor downloadsWindows sensorFalcon console - Question #144Prevention Policy Configuration
When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?
prevention policyhost groupsIOA rule groupspolicy assignment - Question #145Real-Time Response
Which role allows a user to connect to hosts using Real-Time Response?
Real-Time Responseuser rolesRBACActive Responder - Question #146Sensor Deployment and Management
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used...
sensor installationProvNoWaitprovisioning timeoutinstallation parameters - Question #147Host Management and Policy Assignment
How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?
inactive sensorshost managementlast seensensor visibility - Question #148Prevention Policy Configuration
In order to quarantine files on the host, what prevention policy settings must be enabled?
quarantineprevention policyNext-Gen AntivirusSecurity Center Registration - Question #149Sensor Deployment and Management
Why is it critical to have separate sensor update policies for Windows/Mac/*nix?
sensor update policyOS-specific policiescross-platformupdate management - Question #150Host Management and Policy Assignment
How do you assign a policy to a specific group of hosts?
policy assignmenthost groupsstatic assignmentgroup management