Get Instant Access to CCFA-200b Practice Exam Questions [Q12-Q26]

Rate this post

Get Instant Access to CCFA-200b Practice Exam Questions

Reliable Study Materials & Testing Engine for CCFA-200b Exam Success!

NO.12 A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

The host has a user logged into it

The domain controller is preventing the connection

They do not have an RTR role assigned to them

There is another analyst connected into it

The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles: Real Time Response -Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response.

NO.13 The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?

Proxy information

Deep packet inspection

NMAP scanning

TCP inspection

NO.14 Where can you find hosts that have been offline for ten minutes or longer?

Host Management

Sensor Report

Host Groups

Sensor Coverage Dashboard

NO.15 What is the maximum number of patterns that can be added when creating a new exclusion?

The maximum number of patterns that can be added when creating a new exclusion is one. Each exclusion can only have one pattern, which can be a file path, a hash, a command line or a user name. The other options are either incorrect or not related to creating exclusions.

NO.16 How are user permissions set in Falcon?

Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions

Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments

An administrator selects individual granular permissions from the Falcon Permissions List during user creation

Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

User permissions are set in Falcon by assigning pre-defined permissions to sets called roles.
Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments. Roles are collections of permissions that define what users can see and do in Falcon. Permissions are granular actions that allow users to access specific features or functions in Falcon. For example, a user who is assigned both the Falcon Administrator role and the Falcon Investigator role will have all the permissions from both roles.

NO.17 What is the purpose of a containment policy?

To define which Falcon analysts can contain endpoints

To define the duration of Network Containment

To define the trigger under which a machine is put in Network Containment (e.g. a critical detection)

To define allowed IP addresses over which your hosts will communicate when contained

In the Containment Policy page have the title “Network traffic allowlist” and it only allows to add IPs or CIDR networks to exclude in the moment of the isolation of any host, because it is a global policy, not allowing make distinctions between machines.

NO.18 When a user initiates a sensor install, where can the logs be found?

%LOCALAPPDATA%Logs

%SYSTEMROOT%Logs

%LOCALAPPDATA%Temp

%SYSTEMROOT%Temp

NO.19 What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

To group hosts with others in the same business unit

To group hosts according to the order in which Falcon was installed, so that updates are installed in the same order every time

To prioritize the order in which Falcon updates are installed, so that updates are not installed all at once leading to network congestion

To allow the controlled assignment of sensor versions onto specific hosts

The purpose of using groups with Sensor Update policies in CrowdStrike Falcon is to allow the controlled assignment of sensor versions onto specific hosts. This allows users to manage the sensor updates for different hosts based on their needs and preferences, such as testing, staging or production. The other options are either incorrect or not related to using groups with Sensor Update policies.

NO.20 Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

There may be special considerations for each OS

To assist with testing and tracking sensor rollouts

The network protocols are different for each host OS

It is an auditing requirement

NO.21 While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

Configure a Real Time Response policy allowlist with the specific IP addresses

Configure a Containment Policy with the specific IP addresses

Configure a Containment Policy with the entire internal IP CIDR block

Configure the Host firewall to allowlist the specific IP addresses

While a host is Network contained, the administrator can allow the host to access internal network resources on specific IP addresses to perform patching and remediation by configuring a Containment Policy with the specific IP addresses. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment.

NO.22 When an API client is created, what two pieces of information must be generated as a pair to successfully identify and validate your API integrations?

Client ID and Secret

Client ID and OAuth2 ID

Customer ID and Secret

Customer ID and Integration ID

NO.23 What may prevent a user from logging into Falcon via single sign-on (SSO)?

The SSO username doesn’t match their email address in Falcon

The maintenance token has expired

Falcon is in reduced functionality mode

The user never configured their security questions

The option that may prevent a user from logging into Falcon via single sign-on (SSO) is that the SSO username doesn’t match their email address in Falcon. SSO is a feature that allows you to use an external identity provider (IdP) to authenticate and authorize users to access the Falcon platform. SSO simplifies and streamlines the login process, as users only need to remember one set of credentials for multiple applications. However, SSO requires that the username in the IdP matches the email address in Falcon for each user. If there is a mismatch between the username and the email address, the user will not be able to log into Falcon via SSO.

NO.24 In order to prevent duplicate Agent IDs, what install parameter should be used on VMs to be used as persistent clones?

ProvNoWait=1

/quiet

VM=True

NO_START=1

NO.25 Which statement is TRUE regarding disabling detections on a host?

Hosts with detections disabled will not alert on blocklisted hashes or machine learning detections, but will still alert on lOA-based detections. It will remain that way until detections are enabled again

Hosts with detections disabled will not alert on anything until detections are enabled again

Hosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

Hosts cannot have their detections disabled individually

The statement that is true regarding disabling detections on a host is that hosts with detections disabled will not alert on anything until detections are enabled again. As explained in question
127, disabling detections for a host will stop the sensor from sending any detection or prevention events to the Falcon console, and remove any existing events for that host from the console. This means that the host will not alert on anything, including blocklisted hashes, machine learning detections, or indicator of attack (IOA)-based detections. The host will remain in this state until detections are enabled again.

NO.26 What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?

RFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled.

RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.

RFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon

RFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console

Loading …

CrowdStrike CCFA-200b Exam Syllabus Topics:

Topic	Details
Topic 1	Rules Configuration: This domain involves creating custom IOA rules, configuring exclusions to resolve false positives, managing IOC settings for threat detection, and configuring CID-wide General Settings.
Topic 2	Group Creation: This domain covers assigning endpoints to appropriate groups for policy application and following best practices for managing host group structures.
Topic 3	Policy Application: This domain encompasses configuring prevention policies for security posture, sensor update policies, RTR audit policies, containment policies with IP exclusions, and managing quarantined files.
Topic 4	Workflows: This domain focuses on configuring automated workflows that execute predefined actions when specific triggers or conditions are met.
Topic 5	Sensor Deployment: This domain focuses on verifying installation prerequisites, applying default policies and best practices, uninstalling sensors, and troubleshooting sensor issues across supported operating systems.
Topic 6	Dashboards and Reports: This domain covers understanding different sensor report types and their use cases, and interpreting various audit logs for tracking platform activities.

Validate your Skills with Updated CCFA-200b Exam Questions & Answers and Test Engine: https://www.pdf4test.com/CCFA-200b-dump-torrent.html

Free certification test prep

Get Instant Access to CCFA-200b Practice Exam Questions [Q12-Q26]

CrowdStrike CCFA-200b Exam Syllabus Topics:

Leave a Reply Cancel reply