CCFA-200 PDF Dumps Dec 13, 2024 Exam Questions – Valid CCFA-200 Dumps
Ultimate CCFA-200 Guide to Prepare Free Latest CrowdStrike Practice Tests Dumps
CrowdStrike CCFA-200 (CrowdStrike Certified Falcon Administrator) Certification Exam is an industry-recognized certification that validates the skills and knowledge required to effectively manage and administer CrowdStrike Falcon platform. CrowdStrike Certified Falcon Administrator certification equips professionals with the necessary skills to secure endpoints, detect and respond to threats, and manage the CrowdStrike Falcon platform.
NEW QUESTION # 43
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?
- A. Using IOC Management, add the hash of the binary in question and set the action to "Allow"
- B. Contact support and request that they modify the Machine Learning settings to no longer include this detection
- C. Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
- D. Using IOC Management, add the hash of the binary in question and set the action to "No Action"
Answer: A
Explanation:
Explanation
to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.
NEW QUESTION # 44
Which of the follow should be used with extreme caution because it may introduce additional security risks such as malware or other attacks which would not be recorded, detected, or prevented based on the exclusion syntax?
- A. Sensor Visibility Exclusion
- B. Machine Learning Exclusions
- C. IOA Exclusions
- D. IOC Exclusions
Answer: C
Explanation:
Explanation
The option that should be used with extreme caution because it may introduce additional security risks such as malware or other attacks which would not be recorded, detected, or prevented based on the exclusion syntax is IOA Exclusions. An IOA (indicator of attack) exclusion allows you to define custom rules for excluding suspicious behavior from detection or prevention based on process execution, file write, network connection, or registry events. However, using IOA exclusions may reduce the visibility and protection of the Falcon sensor, as it may allow malicious activity to bypass the sensor's detection and prevention capabilities. Therefore, you should use IOA exclusions with extreme caution and only when necessary2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 45
Which of the following prevention policy settings monitors contents of scripts and shells for execution of malicious content on compatible operating systems?
- A. Suspicious Scripts and Commands
- B. FileSystem Visibility
- C. Engine (Full Visibility)
- D. Script-based Execution Monitoring
Answer: D
Explanation:
Explanation
The prevention policy setting that monitors contents of scripts and shells for execution of malicious content on compatible operating systems is Script-based Execution Monitoring. Script-based Execution Monitoring is a feature that enables the Falcon sensor to monitor and prevent malicious script execution on Windows systems.
The feature uses machine learning and behavioral analysis to detect suspicious scripts or commands executed by various script interpreters, such as PowerShell, WScript, CScript, or Bash. You can enable or disable Script-based Execution Monitoring in the Prevention Policy for Windows hosts1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 46
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?
- A. Add the CISO's email to the existing action
- B. Clone the workflow and replace the existing email with your CISO's email
- C. Add a sequential action to send a custom email to your CISO
- D. Add a parallel action to send a custom email to your CISO
Answer: C
NEW QUESTION # 47
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?
- A. Real Time Responder - Script Developer
- B. Real Time Responder - Read Only Analyst
- C. Real Time Responder - Active Responder
- D. Real Time Responder - Administrator
Answer: A
NEW QUESTION # 48
Which of the following Machine Learning (ML) sliders will only detect or prevent high confidence malicious items?
- A. Cautious
- B. Aggressive
- C. Minimal
- D. Moderate
Answer: A
Explanation:
Explanation
The Machine Learning (ML) slider that will only detect or prevent high confidence malicious items is Cautious. The ML slider allows you to adjust the level of sensitivity and aggressiveness of the Falcon sensor's ML engine, which uses artificial intelligence to identify and stop unknown threats. The Cautious setting will enable the sensor to detect and prevent only high-confidence malicious events, while allowing low-confidence events to run without interference. This setting will also generate less noise and false positives than higher settings, such as Moderate or Extra Aggressive1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 49
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?
- A. Sensor version set to N-2 and Bulk maintenance mode is turned on
- B. Sensor version fixed and Uninstall and maintenance protection turned on
- C. Sensor version set to N-1 and Bulk maintenance mode is turned on
- D. Sensor version updates off and Uninstall and maintenance protection turned off
Answer: B
NEW QUESTION # 50
What impact does disabling detections on a host have on an API?
- A. DetectionSummaryEvent stops sending to the Streaming API for that host
- B. Endpoints with detections disabled will not alert on anything until detections are enabled again
- C. Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed
- D. Endpoints cannot have their detections disabled individually
Answer: C
NEW QUESTION # 51
Where in the console can you find a list of all hosts in your environment that are in Reduced Functionality Mode (RFM)?
- A. Inactive Sensor Report
- B. Host Management > Filter for RFM
- C. Containment Policy
- D. Host Dashboard
Answer: B
Explanation:
Explanation
The place in the console where you can find a list of all hosts in your environment that are in Reduced Functionality Mode (RFM) is Host Management > Filter for RFM. The Host Management page allows you to view and manage all hosts in your environment that have Falcon sensors installed. You can use the filter bar to filter hosts by various attributes, such as status, platform, type, or group. You can also filter hosts by health events, such as RFM, which is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. By filtering for RFM, you can see a list of all hosts that are in this mode1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 52
To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?
- A. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
- B. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
- C. Using IOC management, import the list of hashes and IP addresses and set the action to No Action
- D. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
Answer: A
Explanation:
Explanation
IOC management only allows "Detect only" and "No Action" among the possible actions. Therefore, it cannot be used to block based on IPs or domains. Custom IOA Rule groups allow to create rule types based on Network Connection (configuring a remote IP address) and domains, and gives the options to "Monitor",
"Detect" and "Kill Process", being the late one the closest to "block".
NEW QUESTION # 53
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?
- A. Base URL
- B. Client ID
- C. Secret
- D. Client name
Answer: C
Explanation:
Explanation
When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.
Reference: CrowdStrike Falcon User Guide, page 54.
NEW QUESTION # 54
Which of the following best describes the Default Sensor Update policy?
- A. The Default Sensor Update policy is disabled by default
- B. The Default Sensor Update policy does not have the "Uninstall and maintenance protection" feature
- C. The Default Sensor Update policy is only used for testing sensor updates
- D. The Default Sensor Update policy is a "catch-all" policy
Answer: D
Explanation:
Explanation
The Default Sensor Update policy is a "catch-all" policy. This means that any host that is not assigned to a specific sensor update policy will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is enabled by default and has the "Uninstall and maintenance protection" feature turned on. You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 55
Why is it critical to have separate sensor update policies for Windows/Mac/*nix?
- A. To assist with testing and tracking sensor rollouts
- B. The network protocols are different for each host OS
- C. It is an auditing requirement
- D. There may be special considerations for each OS
Answer: C
NEW QUESTION # 56
Which command would tell you if a Falcon Sensor was running on a Windows host?
- A. cswindiag.exe -status
- B. sc.exe query csagent
- C. netstat.exe -f
- D. sc.exe query falcon
Answer: B
Explanation:
Explanation
The command that would tell you if a Falcon Sensor was running on a Windows host is sc.exe query csagent.
This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused. If the service is running, the sensor is also running3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 57
Which option allows you to exclude behavioral detections from the detections page?
- A. Sensor Visibility Exclusion
- B. Machine Learning Exclusion
- C. IOA Exclusion
- D. IOC Exclusion
Answer: B
NEW QUESTION # 58
When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?
- A. Create a Dynamic Group and Import All Workstations
- B. Create a Static Group with Type=Workstation Assignment
- C. Create a Static Group and Import all Workstations
- D. Create a Dynamic Group with Type=Workstation Assignment
Answer: D
Explanation:
Explanation
The best method to ensure all workstation hosts are added to the group is to create a Dynamic Group with Type=Workstation Assignment. A Dynamic Group is a group that automatically updates its membership based on certain criteria or filters. A Type=Workstation Assignment filter will match all hosts that have the workstation type assigned in their Active Directory domain. This way, any new or existing workstation hosts will be added to the group without manual intervention1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 59
In order to quarantine files on the host, what prevention policy settings must be enabled?
- A. Malware Protection and Custom Execution Blocking must be enabled
- B. Malware Protection and Windows Anti-Malware Execution Blocking must be enabled
- C. Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled
- D. Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled
Answer: B
NEW QUESTION # 60
When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?
- A. Create a Dynamic Group and Import All Workstations
- B. Create a Static Group with Type=Workstation Assignment
- C. Create a Static Group and Import all Workstations
- D. Create a Dynamic Group with Type=Workstation Assignment
Answer: D
NEW QUESTION # 61
What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?
- A. Security ID (SID)
- B. Computer ID (CID)
- C. Agent ID (AID)
- D. Endpoint ID (EID)
Answer: C
NEW QUESTION # 62
When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?
- A. Customer ID (CID)
- B. Agent ID (AID)
- C. Maintenance token
- D. Bulk update key
Answer: C
NEW QUESTION # 63
What is the purpose of a containment policy?
- A. To define the duration of Network Containment
- B. To define allowed IP addresses over which your hosts will communicate when contained
- C. To define which Falcon analysts can contain endpoints
- D. To define the trigger under which a machine is put in Network Containment (e.g. a critical detection)
Answer: B
Explanation:
Explanation
In the Containment Policy page have the title "Network traffic allowlist" and it only allows to add IPs or CIDR networks to exclude in the moment of the isolation of any host, because it is a global policy, not allowing make distinctions between machines.
NEW QUESTION # 64
When creating new IOCs in IOC management, which of the following fields must be configured?
- A. Hash, Action and Expiry Date
- B. Filename, Severity and Expiry Date
- C. Hash, Platform and Action
- D. Hash, Description, Filename
Answer: C
Explanation:
Explanation
When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac. The Action field is the action that Falcon will take when detecting the IOC, such as Detect, Block or Allow. The other fields are either optional or not available. Reference: CrowdStrike Falcon User Guide, page 44
NEW QUESTION # 65
......
Passing Key To Getting CCFA-200 Certified Exam Engine PDF: https://www.practicetorrent.com/CCFA-200-practice-exam-torrent.html
Get Top-Rated CrowdStrike CCFA-200 Exam Dumps Now: https://drive.google.com/open?id=1IVnw8s5E_Op1spg71UgOExsQGYQ3M-E6