QUESTION: 33

Where can you modify settings to permit certain traffic during a containment period?

Prevention Policy
Host Settings
Containment Policy
Firewall Settings

Answer(s): C

Explanation:

The administrator can modify settings to permit certain traffic during a containment period by creating or editing a Containment Policy. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment.

Reference:

[CrowdStrike Falcon User Guide], page 40.

Reveal Solution Next Question

QUESTION: 34

Which option allows you to exclude behavioral detections from the detections page?

Machine Learning Exclusion
IOA Exclusion
IOC Exclusion
Sensor Visibility Exclusion

Answer(s): B

Explanation:

IOA Exclusion says - Stop all behavioral detections and preventions for an IOA that's based on a CrowdStrike-generated detection. Source:
https://falcon.crowdstrike.com/documentation/68/detection-and-prevention-policies#exclusions

Reveal Solution Next Question

QUESTION: 35

What are custom alerts based on?

Custom workflows
Custom event based triggers
Predefined alert templates
User defined Splunk queries

Answer(s): C

Explanation:

Scheduling a Custom Alert for your environment consists of three steps: choosing the template you'd like to configure, previewing the search results, then scheduling the alert. Use Custom Alerts to configure email alerts using predefined templates so you're notified about specific activity in your environment.
When an alert runs and finds results, it sends an email to specified recipients instead of generating a new detection. Custom Alerts let you set up email alerts based on predefined templates that cover a wide range of topics including Real Time Response session initiation, host containment, OS security settings, and more that are not yet covered by notification workflows.

Reveal Solution Next Question

QUESTION: 36

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

Base URL
Secret
Client ID
Client name

Answer(s): B

Explanation:

When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.

Reference:

CrowdStrike Falcon User Guide, page 54.

Reveal Solution Next Question

Free CCFA-200 Exam Braindumps

QUESTION: 33

Explanation:

Reference:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation:

QUESTION: 36

Explanation:

Reference: