What information is provided in Logan Activities under Visibility Reports?
Answer(s): B
The Logon Activities report under Visibility Reports provides a list of last endpoints that a user logged in to. This report shows the user name, domain name, logon type, logon time and endpoint name for each logon event. The other options are either incorrect or not related to the report.
[CrowdStrike Falcon User Guide], page 50.
What can the Quarantine Manager role do?
The Quarantine Manager role can manage quarantined files to release and download. This role allows users to view and search quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability.
[CrowdStrike Falcon User Guide], page 19.
What command should be run to verify if a Windows sensor is running?
The command that should be run to verify if a Windows sensor is running is sc query csagent. This command will display the status and information of the csagent service, which is the Falcon sensor service. The other commands are either incorrect or not applicable to Windows sensors.
[CrowdStrike Falcon User Guide], page 29.
When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?
Answer(s): A
Prevention Policies are created based on the OS (Windows, MAC and Linux policies). Once a prevention policy is created, three options appear on top: Settings, Assigned Host Groups and Assigned Custom IOAS (tested on Crowdstrike). Therefore, Host Groups and Custom IOAS are the two different types of groups a prevention policy can be aligned to.
Which role allows a user to connect to hosts using Real-Time Response?
Answer(s): C
The role that allows a user to connect to hosts using Real-Time Response is Real Time Responder Active Responder. This role allows users to use the "Connect to Host" feature to gather additional information from the host, as well as execute commands and scripts on the host. The other roles do not have this capability.
[CrowdStrike Falcon User Guide], page 18.
Post your Comments and Discuss CrowdStrike CCFA-200 exam dumps with other Community members:
DynamoDB
S3
Cognito
RDS
EFS
/sbin/init
/etc/inittab
/etc/rc.d
/etc/init.d
/lib/init.so
/etc/rc.d/rcinit
/proc/sys/kernel/init
/boot/init
/bin/init
Amazon S3 Intelligent-Tiering
S3 Lifecycle
S3 Glacier Flexible Retrieval
Amazon Athena
Amazon EFS
EC2 instance store
ElastiCache for Redis
S3 Glacier Deep Archive
AWS Lake Formation
Amazon EMR Spark jobs
Amazon Kinesis Data Streams
Amazon DynamoDB
Defender for Endpoint
Defender for Identity
Defender for Cloud Apps
Defender for Office 365
S3 Object Lock
SFTP
AWS Transfer Family
Amazon SQS
API Gateway
Lambda
usage plan
AWS WAF
Amazon ECS
Application Load Balancer
AWS Global Accelerator
Network Load Balancer
EC2
Auto Scaling group
CloudFront
ALB
AWS PrivateLink
CRR
SSE-S3
Athena
SSE-KMS
RDS Custom for Oracle
s3:GetObject
Amazon OpenSearch Service
CloudWatch Logs
Kinesis Data Firehose
Kinesis
S3 bucket
SQS
AWS Lambda
AWS Secrets Manager
AWS Systems Manager OpsCenter
secretsmanager:GetSecretValue
seq
for h in {1..254}
for h in $(seq 1 254); do
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFA-200 content, but please register or login to continue.