QUESTION: 73

Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

Sensor Report
Machine Learning Prevention Monitoring
Falcon UI Audit Trail
Machine Learning Debug

Answer(s): B

Explanation:

The Machine Learning Prevention Monitoring report in the Prevention Policy Management option allows you to monitor the impact of machine learning (ML) prevention settings on your environment. You can view the number of ML detections and preventions by severity, policy, and host group. You can also drill down into specific events and hosts to see more details. This report can help you determine the appropriate ML levels to set in a prevention policy based on your risk tolerance and security posture.

Reference:

Falcon Administrator Learning Path | Infographic | CrowdStrike

Reveal Solution Next Question

QUESTION: 74

Why is the ability to disable detections helpful?

It gives users the ability to set up hosts to test detections and later remove them from the console
It gives users the ability to uninstall the sensor from a host
It gives users the ability to allowlist a false positive detection
It gives users the ability to remove all data from hosts that have been uninstalled

Answer(s): A

Explanation:

"Disable Detections. This is helpful for users who want to set up hosts to test detections in the Falcon console and who later want to remove those old test detections from the"

Reveal Solution Next Question

QUESTION: 75

The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.

the account type for the user (e.g. Domain Administrator, Local User)
all hosts the user logged into
the logon type (e.g. interactive, service)
the last time the user's password was set

Answer(s): B

Explanation:

Checked in console, it returns only the last machine where the user logged on, so it will not return all the machines that the user was logged on in the desired search

Reveal Solution Next Question

QUESTION: 76

An analyst has reported they are not receiving workflow triggered notifications in the past few days.
Where should you first check for potential failures?

Custom Alert History
Workflow Execution log
Workflow Audit log
Falcon UI Audit Trail

Answer(s): B

Explanation:

The Workflow Execution log in the Workflow Management option allows you to view the status and results of workflow executions triggered by detection events. You can filter the log by workflow name, status, start and end time, and detection ID. You can also view the details of each execution, including the actions performed, the output received, and any errors encountered. This log can help you troubleshoot potential failures or issues with your workflows.

Reference:

Falcon Administrator Learning Path | Infographic | CrowdStrike

Reveal Solution Next Question

Free CCFA-200 Exam Braindumps (page: 19)

QUESTION: 73

Explanation:

Reference:

QUESTION: 74

Explanation:

QUESTION: 75

Explanation:

QUESTION: 76

Explanation:

Reference: