QUESTION: 65

You need to export a list of all deletions for a specific Host Name in the last 24 hours.
What is the best way to do this?

Go to Host Management in the Host page. Select the host and use the Export Detections button
Utilize the Detection Resolution Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detection Resolution History" section
In the Investigate module, access the Detection Activity page. Use the filters to focus on the appropriate hostname and time, then export the results
Utilize the Detection Activity Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detections by Host" section

Answer(s): C

Explanation:

The best way to export a list of all deletions for a specific Host Name in the last 24 hours is to go to the Investigate module, access the Detection Activity page, use the filters to focus on the appropriate hostname and time, then export the results. This will allow you to download a CSV file that contains information about all the detections that were deleted for that host in that time period. The other options are either incorrect or not related to exporting deletions.

Reference:

CrowdStrike Falcon User Guide, page 49.

Reveal Solution Next Question

QUESTION: 66

Which role will allow someone to manage quarantine files?

Falcon Security Lead
Detections Exceptions Manager
Falcon Analyst Read Only
Endpoint Manager

Answer(s): A

Explanation:

The role that will allow someone to manage quarantine files is Falcon Security Lead. This role allows users to view and manage quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability.

Reference:

CrowdStrike Falcon User Guide, page 19.

Reveal Solution Next Question

QUESTION: 67

What is the maximum number of patterns that can be added when creating a new exclusion?

Answer(s): C

Explanation:

The maximum number of patterns that can be added when creating a new exclusion is one. Each exclusion can only have one pattern, which can be a file path, a hash, a command line or a user name. The other options are either incorrect or not related to creating exclusions.

Reference:

CrowdStrike Falcon User Guide, page 37.

Reveal Solution Next Question

QUESTION: 68

You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

Prevention Policy Audit Trail
Prevention Policy Debug
Prevention Hashes Ignored
Machine-Learning Prevention Monitoring

Answer(s): D

Explanation:

Audit logs --> Machine-learning prevention monitoring It shows the count of ML expected detections based on the detection levels for a defined time period and the list of files that would be detected on each detection level.

Reveal Solution Next Question

Free CCFA-200 Exam Braindumps (page: 17)

QUESTION: 65

Explanation:

Reference:

QUESTION: 66

Explanation:

Reference:

QUESTION: 67

Explanation:

Reference:

QUESTION: 68

Explanation: