QUESTION: 29

Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

There may be special considerations for each OS
To assist with testing and tracking sensor rollouts
The network protocols are different for each host OS
It is an auditing requirement

Answer(s): A

Explanation:

https://www.crowdstrike.com/blog/tech-center/how-to-manage-policies-in-falcon/

Reveal Solution Next Question

QUESTION: 30

How do you assign a policy to a specific group of hosts?

Create a group containing the desired hosts using "Static Assignment." Go to the Assigned Host Groups tab of the desired policy and dick "Add groups to policy." Select the desired Group(s).
Assign a tag to the desired hosts in Host Management. Create a group with an assignment rule based on that tag. Go to the Assignment tab of the desired policy and click "Add Groups to Policy."
Select the desired Group(s).
Create a group containing the desired hosts using "Dynamic Assignment." Go to the Assigned Host Groups tab of the desired policy and select criteria such as OU, OS, Hostname pattern, etc.
On the Assignment tab of the desired policy, select "Static" assignment. From the next window, select the desired hosts (using fitters if needed) and click Add.

Answer(s): A

Explanation:

The administrator can assign a policy to a specific group of hosts by creating a group containing the desired hosts using "Static Assignment." Then, go to the Assigned Host Groups tab of the desired policy and click "Add groups to policy." Select the desired Group(s). This will apply the policy to the selected group(s) of hosts. The other options are either incorrect or not applicable to static assignment.

Reference:

[CrowdStrike Falcon User Guide], page 33.

Reveal Solution Next Question

QUESTION: 31

You want to create a detection-only policy. How do you set this up in your policy's settings?

Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.
Select the "Detect-Only" template. Disable hash blocking and exclusions.
You can't create a policy that detects but does not prevent. Use Custom IOA rules to detect.
Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.

Answer(s): D

Explanation:

The administrator can create a detection-only policy by setting the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled in the policy's settings. This will allow Falcon to detect but not prevent threats on the hosts using this policy. Do not activate any of the other blocking or malware prevention options, as they will enable prevention actions. The other options are either incorrect or not related to creating a detection-only policy.

Reference:

[CrowdStrike Falcon User Guide], page 35.

Reveal Solution Next Question

QUESTION: 32

Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?

.*badguydomain.com.*
\Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill
badguydomain\.com.*
Custom IOA rules cannot be created for domains

Answer(s): A

Explanation:

You are usuing RegEx here and need leading ".*" to capture www and then need a ".*" at the end to identify any sites falling under badguydomain.com

Reveal Solution Next Question

Free CCFA-200 Exam Braindumps (page: 8)

QUESTION: 29

Explanation:

QUESTION: 30

Explanation:

Reference:

QUESTION: 31

Explanation:

Reference:

QUESTION: 32

Explanation: