Get Prepared for Your CCFA-200 Exam With Actual CrowdStrike Study Guide!
Pass Your Next CCFA-200 Certification Exam Easily & Hassle Free
NEW QUESTION # 88
When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?
- A. Custom IOC Groups
- B. Operating System Groups
- C. Custom IOA Rule Groups
- D. Enterprise Groups
Answer: C
Explanation:
Explanation
Prevention Policies are created based on the OS (Windows, MAC and Linux policies). Once a prevention policy is created, three options appear on top: Settings, Assigned Host Groups and Assigned Custom IOAS (tested on Crowdstrike). Therefore, Host Groups and Custom IOAS are the two different types of groups a prevention policy can be aligned to.
NEW QUESTION # 89
Which of the follow should be used with extreme caution because it may introduce additional security risks such as malware or other attacks which would not be recorded, detected, or prevented based on the exclusion syntax?
- A. IOA Exclusions
- B. Sensor Visibility Exclusion
- C. Machine Learning Exclusions
- D. IOC Exclusions
Answer: A
Explanation:
Explanation
The option that should be used with extreme caution because it may introduce additional security risks such as malware or other attacks which would not be recorded, detected, or prevented based on the exclusion syntax is IOA Exclusions. An IOA (indicator of attack) exclusion allows you to define custom rules for excluding suspicious behavior from detection or prevention based on process execution, file write, network connection, or registry events. However, using IOA exclusions may reduce the visibility and protection of the Falcon sensor, as it may allow malicious activity to bypass the sensor's detection and prevention capabilities. Therefore, you should use IOA exclusions with extreme caution and only when necessary2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 90
Which Real Time Response role will allow you to see all analyst session details?
- A. None of the Real Time Response roles allows this
- B. Real Time Response -Administrator
- C. Real Time Response - Read-Only Analyst
- D. Real Time Response -Active Responder
Answer: B
Explanation:
Explanation
The Real Time Response role that will allow you to see all analyst session details is Real Time Response
-Administrator. A Real Time Response -Administrator is a role that has full access and control over the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. A Real Time Response -Administrator can view all analyst session details, such as session ID, host name, start and end time, commands executed, and output received. A Real Time Response -Administrator can also create, modify, delete, and assign scripts and commands to other analysts2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 91
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?
- A. Add the CISO's email to the existing action
- B. Clone the workflow and replace the existing email with your CISO's email
- C. Add a sequential action to send a custom email to your CISO
- D. Add a parallel action to send a custom email to your CISO
Answer: D
Explanation:
Explanation
The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start. By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 92
What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?
- A. Falcon console updates are pending
- B. Falcon sensors installing an update
- C. Notifications have been disabled on that host sensor
- D. Microsoft updates
Answer: C
NEW QUESTION # 93
When a host is placed in Network Containment, which of the following is TRUE?
- A. The host machine is unable to send or receive any network traffic
- B. The host machine is unable to send or receive network traffic outside of the local network
- C. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and traffic allowed in the Firewall Policy
- D. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy
Answer: D
Explanation:
Explanation
When a host is placed in Network Containment, the host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy. This allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential services. The other options are either incorrect or not true of Network Containment.
Reference: CrowdStrike Falcon User Guide, page 40.
NEW QUESTION # 94
What can the Quarantine Manager role do?
- A. Manage detection settings
- B. Manage quarantined files to release and download
- C. Manage and change prevention settings
- D. Manage roles and users
Answer: B
NEW QUESTION # 95
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?
- A. Client name
- B. Client ID
- C. Base URL
- D. Secret
Answer: D
Explanation:
Explanation
When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.
Reference: CrowdStrike Falcon User Guide, page 54.
NEW QUESTION # 96
What can exclusions be applied to?
- A. Only the groups selected by the administrator
- B. Only the default host group
- C. Either all hosts or specified groups
- D. Individual hosts selected by the administrator
Answer: C
Explanation:
Explanation
The option that describes what exclusions can be applied to is that exclusions can be applied to either all hosts or specified groups. An exclusion is a rule that defines what files, folders, processes, IP addresses, or domains should be excluded from detection or prevention by the Falcon sensor. You can create and manage exclusions in the Exclusions page in the Falcon console. You can apply exclusions to either all hosts in your environment or to specific host groups that you select. You cannot apply exclusions to individual hosts selected by the administrator.
References: : [Cybersecurity Resources | CrowdStrike]
NEW QUESTION # 97
How can a API client secret be viewed after it has been created?
- A. Selecting "show secret" within the 3-dot dropdown menu will reveal the secret for the selected api client
- B. The API client secret can be provided by support via direct email request from a Falcon Administrator
- C. Within the API management page, API client secrets can be accessed within the "edit client" functionality
- D. The API client secret must be reset or a new client created as the secret cannot be viewed after it has been created
Answer: D
Explanation:
Explanation
The way an API client secret can be viewed after it has been created is that the API client secret must be reset or a new client created as the secret cannot be viewed after it has been created. As explained in question 137, an API client secret is only displayed once during creation for security reasons. If you lose or forget your API client secret, you cannot view it again in the Falcon console. You have two options to resolve this issue: either reset your API client secret or create a new API client. Resetting your API client secret will generate a new secret for your existing API client, which will invalidate any previous secret. Creating a new API client will generate a new API client ID and secret, which will require you to update any applications or scripts that use the Falcon APIs2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 98
Which role allows a user to connect to hosts using Real-Time Response?
- A. Endpoint Manager
- B. Falcon Administrator
- C. Prevention Hashes Manager
- D. Real Time Responder - Active Responder
Answer: D
NEW QUESTION # 99
Once an exclusion is saved, what can be edited in the future?
- A. All parts of the exclusion can be changed
- B. Only the options to "Detect/Block" and/or "File Extraction" can be changed
- C. The exclusion pattern cannot be changed
- D. Only the selected groups and hosts to which the exclusion is applied can be changed
Answer: A
NEW QUESTION # 100
Which of the following applies to Custom Blocking Prevention Policy settings?
- A. Blocklisting applies to hashes, IP addresses, and domains
- B. You can only blocklist hashes via the API
- C. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
- D. Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
Answer: D
NEW QUESTION # 101
Which of the following uses Regex to create a detection or take a preventative action?
- A. Custom IOA
- B. Machine Learning Exclusion
- C. Sensor Visibility Exclusion
- D. Custom IOC
Answer: A
Explanation:
Explanation
The option that uses regex to create a detection or take a preventative action is Custom IOA. A Custom IOA (indicator of attack) allows you to define custom rules for detecting or preventing suspicious behavior based on process execution, file write, network connection, or registry events. You can use regex syntax to create a Custom IOA rule that matches the event data that you want to monitor or block1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 102
On a Windows host, what is the best command to determine if the sensor is currently running?
- A. sc query csagent
- B. ping falcon.crowdstrike.com
- C. This cannot be accomplished with a command
- D. netstat -a
Answer: A
NEW QUESTION # 103
What are custom alerts based on?
- A. Predefined alert templates
- B. Custom event based triggers
- C. User defined Splunk queries
- D. Custom workflows
Answer: A
Explanation:
Explanation
Scheduling a Custom Alert for your environment consists of three steps: choosing the template you'd like to configure, previewing the search results, then scheduling the alert. Use Custom Alerts to configure email alerts using predefined templates so you're notified about specific activity in your environment. When an alert runs and finds results, it sends an email to specified recipients instead of generating a new detection. Custom Alerts let you set up email alerts based on predefined templates that cover a wide range of topics including Real Time Response session initiation, host containment, OS security settings, and more that are not yet covered by notification workflows.
NEW QUESTION # 104
Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?
- A. Falcon Analyst - Read Only
- B. Real Time Responder - Read Only Analyst
- C. Real Time Responder - Active Responder
- D. Remediation Manager
Answer: A
NEW QUESTION # 105
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?
- A. Real Time Responder - Administrator
- B. Real Time Responder - Read Only Analyst
- C. Real Time Responder - Active Responder
- D. Real Time Responder - Script Developer
Answer: D
NEW QUESTION # 106
After agent installation, an agent opens a permanent___connection over port 443 and keeps that connection open until the endpoint is turned off or the network connection is terminated.
- A. HTTP
- B. TLS
- C. TCP
- D. SSH
Answer: B
Explanation:
Explanation
After agent installation, an agent opens a permanent TLS connection over port 443 and keeps that connection open until the endpoint is turned off or the network connection is terminated. TLS (Transport Layer Security) is a protocol that provides secure and encrypted communication between the agent and the Falcon cloud. Port
443 is the standard port for HTTPS (Hypertext Transfer Protocol Secure) traffic. The agent uses this connection to send and receive data, commands, policies, and updates from the Falcon cloud2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 107
You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?
- A. Detection slider: Extra Aggressive
Prevention slider: Cautious - B. Detection slider: Moderate
Prevention slider: Disabled - C. Detection slider: Disabled
Prevention slider: Disabled - D. Detection slider: Cautious
Prevention slider: Cautious
Answer: D
Explanation:
Explanation
The best settings to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase are Cautious for both Detection and Prevention sliders. This setting will enable the sensor to detect and prevent only high-confidence malicious events, while allowing low-confidence events to run without interference. This setting will also generate less noise and false positives than higher settings, such as Moderate or Extra Aggressive1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 108
What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?
- A. For - While statement(s)
- B. Event trigger(s)
- C. Trigger, condition(s) and action(s)
- D. Predefined workflow template(s)
Answer: C
NEW QUESTION # 109
Which role is required to manage groups and policies in Falcon?
- A. Falcon Host Administrator
- B. Falcon Host Security Lead
- C. Prevention Hashes Manager
- D. Falcon Host Analyst
Answer: A
NEW QUESTION # 110
......
Ace CCFA-200 Certification with 152 Actual Questions: https://testking.pdf4test.com/CCFA-200-actual-dumps.html
