When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?
Answer(s): B
When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.
CrowdStrike Falcon User Guide, page 54.
You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?
Answer(s): C
The most likely culprit causing multiple Windows hosts to be in Reduced Functionality Mode (RFM) is a patch that was pushed overnight to all Windows systems. RFM occurs when the sensor detects a change in the operating system that requires a reboot to complete. A patch is one of the common causes of such a change. The other options are either incorrect or not related to RFM.
CrowdStrike Falcon User Guide, page 30.
Which of the following is TRUE of the Logon Activities Report?
Answer(s): D
The Logon Activities Report shows a graphical view of user logon activity and the hosts the user connected to, but it only gives a summary of the last logon activity for users. It does not give a detailed list of all logon activity for users, nor can it be filtered by computer name. The other options are either incorrect or not true of the report.
CrowdStrike Falcon User Guide, page 50.
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?
Answer(s): A
Real Time Responder - Administrator (RTR Administrator) - Can do everything RTR Active Responder can do, plus create custom scripts, upload files to hosts using the put command, and directly run executables using the run command.
What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?
The model that is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform is trigger, condition(s) and action(s). This model allows you to specify what event will trigger the workflow, what condition(s) must be met for the workflow to execute, and what action(s) will be performed by the workflow. The other options are either incorrect or not related to creating workflows.
CrowdStrike Falcon User Guide, page 56.
Post your Comments and Discuss CrowdStrike CCFA-200b exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFA-200b content, but please register or login to continue.