QUESTION: 37

You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

A Sensor Update Policy was misconfigured
A host was offline for more than 24 hours
A patch was pushed overnight to all Windows systems
A host was placed in network containment from a detection

Answer(s): C

Reveal Solution Next Question

QUESTION: 38

Which of the following is TRUE of the Logon Activities Report?

Shows a graphical view of user logon activity and the hosts the user connected to
The report can be filtered by computer name
It gives a detailed list of all logon activity for users
It only gives a summary of the last logon activity for users

Answer(s): C

Reveal Solution Next Question

QUESTION: 39

Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

Real Time Responder – Administrator
Real Time Responder – Read Only Analyst
Real Time Responder – Script Developer
Real Time Responder – Active Responder

Answer(s): C

Reveal Solution Next Question

QUESTION: 40

What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

For - While statement(s)
Trigger, condition(s) and action(s)
Event trigger(s)
Predefined workflow template(s)

Answer(s): B

Reveal Solution Next Question

Free CCFA Exam Braindumps (page: 11)

QUESTION: 37

QUESTION: 38

QUESTION: 39

QUESTION: 40

CCFA Exam Discussions & Posts