Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?
Answer(s): D
According to documentation (documentation/detections/technique/sensor-based-ml-cst0007): CrowdStrike sensor-based machine learning (ML) identifies and analyzes unknown executables as they run on hosts. This technique is triggered by files and file attributes associated with known malware. This is similar to the [Cloud-based ML](/support/documentation/detections/technique/cloud-based-ml) technique. Cloud-based ML is informed by global analysis of executables that classifies and identifies malware. The key difference is that it doesn't run on hosts when they're offline.
How do you find a list of inactive sensors?
Answer(s): C
The Inactive Sensor Report in the Host setup and management option allows you to view a list of hosts that have not communicated with the Falcon platform for a specified period of time. You can filter the report by sensor version, OS, and last seen date. This report can help you identify hosts that may have connectivity issues or need sensor updates.
1: Falcon Administrator Learning Path | Infographic | CrowdStrike
Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?
Answer(s): B
The Machine Learning Prevention Monitoring report in the Prevention Policy Management option allows you to monitor the impact of machine learning (ML) prevention settings on your environment. You can view the number of ML detections and preventions by severity, policy, and host group. You can also drill down into specific events and hosts to see more details. This report can help you determine the appropriate ML levels to set in a prevention policy based on your risk tolerance and security posture.
Why is the ability to disable detections helpful?
Answer(s): A
"Disable Detections. This is helpful for users who want to set up hosts to test detections in the Falcon console and who later want to remove those old test detections from the"
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.
Checked in console, it returns only the last machine where the user logged on, so it will not return all the machines that the user was logged on in the desired search
Post your Comments and Discuss CrowdStrike CCFA-200b exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFA-200b content, but please register or login to continue.