You want to create a detection-only policy. How do you set this up in your policy's settings?
Answer(s): D
The administrator can create a detection-only policy by setting the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled in the policy’s settings. This will allow Falcon to detect but not prevent threats on the hosts using this policy. Do not activate any of the other blocking or malware prevention options, as they will enable prevention actions. The other options are either incorrect or not related to creating a detection-only policy.
[CrowdStrike Falcon User Guide], page 35.
Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?
Answer(s): A
You are usuing RegEx here and need leading ".*" to capture www and then need a ".*" at the end to identify any sites falling under badguydomain.com
Where can you modify settings to permit certain traffic during a containment period?
Answer(s): C
The administrator can modify settings to permit certain traffic during a containment period by creating or editing a Containment Policy. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment.
[CrowdStrike Falcon User Guide], page 40.
Which option allows you to exclude behavioral detections from the detections page?
Answer(s): B
IOA Exclusion says -Stop all behavioral detections and preventions for an IOA that’s based on a CrowdStrike-generated detection. Source: https://falcon.crowdstrike.com/documentation/68/detection-and-prevention-policies#exclusions
What are custom alerts based on?
Scheduling a Custom Alert for your environment consists of three steps: choosing the template you’d like to configure, previewing the search results, then scheduling the alert. Use Custom Alerts to configure email alerts using predefined templates so you're notified about specific activity in your environment. When an alert runs and finds results, it sends an email to specified recipients instead of generating a new detection. Custom Alerts let you set up email alerts based on predefined templates that cover a wide range of topics including Real Time Response session initiation, host containment, OS security settings, and more that are not yet covered by notification workflows.
Post your Comments and Discuss CrowdStrike CCFA-200b exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFA-200b content, but please register or login to continue.