QUESTION: 49

What impact does disabling detections on a host have on an API?

Endpoints with detections disabled will not alert on anything until detections are enabled again
Endpoints cannot have their detections disabled individually
DetectionSummaryEvent stops sending to the Streaming API for that host
Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

Answer(s): C

Explanation:

Disabling detections on a host will stop the DetectionSummaryEvent from sending to the Streaming API for that host. This means that the host will not send any detection events to the Streaming API, which is used to stream data from the Falcon Cloud to external applications or systems. The other options are either incorrect or not related to disabling detections on a host.

Reference:

[CrowdStrike Falcon User Guide], page 32.

Reveal Solution Next Question

QUESTION: 50

Under which scenario can Sensor Tags be assigned?

While triaging a detection
While managing hosts in the Falcon console
While updating a sensor in the Falcon console
While installing a sensor

Answer(s): D

Explanation:

Check in documentation, there are two kind of tags, the Falcon Grouping Tags that can be managed in falcon console or API and the Sensor Grouping Tags that are configured as parameter in cli, that kind of tags can be diferentiated because it appears with the prefix SensorGroupingTags followed with the name of the tag. If you want to modify a sensor tag is necessary change a registry key value and reboot the device or waiting until the sensor is upgraded.

Reveal Solution Next Question

QUESTION: 51

Custom IOA rules are defined using which syntax?

Glob
PowerShell
Yara
Regex

Answer(s): D

Explanation:

Regex guidelines https://falcon.crowdstrike.com/documentation/68/detection-and-prevention- policies#regex

Reveal Solution Next Question

QUESTION: 52

With Custom Alerts, it is possible to __________.

schedule the alert to run at any interval
receive an alert in an email
configure prevention actions for alerting
be alerted to activity in real-time

Answer(s): B

Explanation:

The reporting interval is predefined and cannot be changed. You can only enable/disable the custom alert feature and add/remove recipient email client for the alert/detection.

Reveal Solution Next Question

Free CCFA-200 Exam Braindumps (page: 13)

QUESTION: 49

Explanation:

Reference:

QUESTION: 50

Explanation:

QUESTION: 51

Explanation:

QUESTION: 52

Explanation: