What is the goal of a Network Containment Policy?
Answer(s): B
The goal of a Network Containment Policy is to limit the impact of a compromised host on the network. This policy allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential services. This can help prevent further damage or data exfiltration from a compromised host. The other options are either incorrect or not related to the policy.
[CrowdStrike Falcon User Guide], page 40.
Which of the following applies to Custom Blocking Prevention Policy settings?
Answer(s): A
Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on “Upload Hashes” in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon® API. https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom-blacklisting/
How many "Auto" sensor version update options are available for Windows Sensor Update Policies?
Answer(s): D
There are three “Auto” sensor version update options available for Windows Sensor Update Policies: Auto - N-1, Auto - TEST-QA and Auto - Latest. These options allow the administrator to automatically update the sensor version to the previous stable version, the latest test version or the latest stable version, respectively.
[CrowdStrike Falcon User Guide], page 38.
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?
The alignment of a particular prevention policy to one or more host groups can be completed in each policy in the “Assigned Host Groups” tab. This tab allows the administrator to select which host groups will use the policy, as well as view the number of hosts and sensors assigned to each group. The other options are either incorrect or not available.
[CrowdStrike Falcon User Guide], page 34.
How long are detection events kept in Falcon?
" Data is only available in the Falcon UI for investigations, etc. through the company’s data retention time frame; detection information is kept for 90 days regardless; UI audits are available for 1 year
Post your Comments and Discuss CrowdStrike CCFA-200b exam prep with other Community members: