Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
Scrum
All Vendors
  2. Home
  3. Exams
  4. CrowdStrike
  5. CCFA

Free CCFA Exam Braindumps (page: 4)

Page 3 of 25
PDF with 248 Questions

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

  1. Remediation Manager
  2. Real Time Responder – Read Only Analyst
  3. Falcon Analyst – Read Only
  4. Real Time Responder – Active Responder

Answer(s): C



One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called "devcode." What setting can you use to reduce false positives on this file path?

  1. USB Device Policy
  2. Firewall Rule Group
  3. Containment Policy
  4. Machine Learning Exclusions

Answer(s): C



How do you disable all detections for a host?

  1. Create an exclusion rule and apply it to the machine or group of machines
  2. Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
  3. You cannot disable all detections on individual hosts as it would put them at risk
  4. In Host Management, select the host and then choose the option to Disable Detections

Answer(s): D



To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

  1. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
  2. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
  3. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
  4. Using IOC management, import the list of hashes and IP addresses and set the action to No Action

Answer(s): C






Post your Comments and Discuss CrowdStrike CCFA exam with other Community members:

Exam Discussions & Posts