[Dec-2024 Newly Released] Pass CCFA-200 Exam – Real Questions & Answers [Q81-Q101]

Rate this post

[Dec-2024 Newly Released] Pass CCFA-200 Exam – Real Questions and Answers

Pass CCFA-200 Review Guide, Reliable CCFA-200 Test Engine

NEW QUESTION 81
When creating new IOCs in IOC management, which of the following fields must be configured?

Hash, Description, Filename

Hash, Action and Expiry Date

Filename, Severity and Expiry Date

Hash, Platform and Action

NEW QUESTION 82
You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

Specific sensor version number

Auto – TEST-QA

Sensor version updates off

Auto – N-1

NEW QUESTION 83
Which of the following can a Falcon Administrator edit in an existing user’s profile?

First or Last name

Phone number

Email address

Working groups

NEW QUESTION 84
How long are detection events kept in Falcon?

Detection events are kept for 90 days

Detections events are kept for your subscribed data retention period

Detection events are kept for 7 days

Detection events are kept for 30 days

NEW QUESTION 85
With Custom Alerts, it is possible to __________.

schedule the alert to run at any interval

receive an alert in an email

configure prevention actions for alerting

be alerted to activity in real-time

NEW QUESTION 86
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?

Sensor version set to N-1 and Bulk maintenance mode is turned on

Sensor version fixed and Uninstall and maintenance protection turned on

Sensor version updates off and Uninstall and maintenance protection turned off

Sensor version set to N-2 and Bulk maintenance mode is turned on

NEW QUESTION 87
What can the Quarantine Manager role do?

Manage and change prevention settings

Manage quarantined files to release and download

Manage detection settings

Manage roles and users

NEW QUESTION 88
An analyst has reported they are not receiving workflow triggered notifications in the past few days. Where should you first check for potential failures?

Custom Alert History

Workflow Execution log

Workflow Audit log

Falcon UI Audit Trail

NEW QUESTION 89
You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

A Sensor Update Policy was misconfigured

A host was offline for more than 24 hours

A patch was pushed overnight to all Windows systems

A host was placed in network containment from a detection

NEW QUESTION 90
What best describes the relationship between Sensor Update policies and Operating Systems?

Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions

Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems

Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies

A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)

NEW QUESTION 91
What can the Quarantine Manager role do?

Manage and change prevention settings

Manage quarantined files to release and download

Manage detection settings

Manage roles and users

NEW QUESTION 92
When uninstalling a sensor, which of the following is required if the ‘Uninstall and maintenance protection’ setting is enabled within the Sensor Update Policies?

Maintenance token

Customer ID (CID)

Bulk update key

Agent ID (AID)

NEW QUESTION 93
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20-minute default provisioning window?

ExtendedWindow=1

Timeout=0

ProvNoWait=1

Timeout=30

NEW QUESTION 94
How long are detection events kept in Falcon?

Detection events are kept for 90 days

Detections events are kept for your subscribed data retention period

Detection events are kept for 7 days

Detection events are kept for 30 days

NEW QUESTION 95
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?

Policy alignment is configured in the “Host Management” section in the Hosts application

Policy alignment is configured only once during the initial creation of the policy in the “Create New Policy” pop-up window

Policy alignment is configured in the General Settings section under the Configuration menu

Policy alignment is configured in each policy in the “Assigned Host Groups” tab

NEW QUESTION 96
An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

File exclusions are not aligned to groups or hosts

There is a limit of three groups of hosts applied to any exclusion

There is no limit and exclusions can be applied to any or all groups

Each exclusion can be aligned to only one group of hosts

NEW QUESTION 97
When would the No Action option be assigned to a hash in IOC Management?

When you want to save the indicator for later action, but do not want to block or allow it at this time

Add the indicator to your allowlist and do not detect it

There is no such option as No Action available in the Falcon console

Add the indicator to your blocklist and show it as a detection

NEW QUESTION 98
The Falcon Administrator has created a new prevention policy to apply to the “Servers” group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?

The new prevention policy should be enabled first

The “Servers” group already has a policy applied to it

The “Servers” group must be disabled first

Host type was not defined correctly within the prevention policy

NEW QUESTION 99
How does the Unique Hosts Connecting to Countries Map help an administrator?

It highlights countries with known malware

It helps visualize global network communication

It identifies connections containing threats

It displays intrusions from foreign countries

NEW QUESTION 100
Why would you assign hosts to a static group instead of a dynamic group?

You do not want the group membership to change automatically

You are managing more than 1000 hosts

You need hosts to be automatically assigned to a group

You want the group to contain hosts from multiple operating systems

NEW QUESTION 101
How do you disable all detections for a host?

Create an exclusion rule and apply it to the machine or group of machines

Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)

You cannot disable all detections on individual hosts as it would put them at risk

In Host Management, select the host and then choose the option to Disable Detections

100% Free CCFA-200 Daily Practice Exam With 152 Questions: https://www.test4cram.com/CCFA-200_real-exam-dumps.html

Leave a Reply Cancel reply