CCFA-200 Premium Files Updated Jan-2024 Practice Valid Exam Dumps Question
Practice with CCFA-200 Dumps for CrowdStrike Certified Falcon Administrator Certified Exam Questions & Answer
NEW QUESTION # 81
On which page of the Falcon console would you create sensor groups?
- A. User management
- B. Sensor update policies
- C. Host groups
- D. Host management
Answer: C
Explanation:
Explanation
The only place where create host groups is in " Host and setup management > host Groups> Create a group" In Sensor Update policies you can only asign a group of host to the policy not creating a group of hosts.
NEW QUESTION # 82
Which of the following scenarios best describes when you would add IP addresses to the containment policy?
- A. A new group of analysts need to be able to place hosts under Network Containment
- B. Your organization has additional IP addresses that need to be able to access the Falcon console
- C. Your organization has resources that need to be accessible when hosts are network contained
- D. You want to automate the Network Containment process based on the IP address of a host
Answer: C
Explanation:
Explanation
The scenario that best describes when you would add IP addresses to the containment policy is that your organization has resources that need to be accessible when hosts are network contained. As explained in the previous question, adding IP addresses to the containment policy allows you to create an allowlist of trusted IP addresses that can communicate with your contained hosts. This can be useful when you need to isolate a host from the network due to a potential compromise or investigation, but still want to allow it to access certain resources or services that are essential for your organization's operations or security2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 83
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?
- A. Clone the workflow and replace the existing email with your CISO's email
- B. Add a parallel action to send a custom email to your CISO
- C. Add a sequential action to send a custom email to your CISO
- D. Add the CISO's email to the existing action
Answer: C
NEW QUESTION # 84
Which of the following is TRUE of the Logon Activities Report?
- A. The report can be filtered by computer name
- B. It gives a detailed list of all logon activity for users
- C. It only gives a summary of the last logon activity for users
- D. Shows a graphical view of user logon activity and the hosts the user connected to
Answer: B
NEW QUESTION # 85
Why would you assign hosts to a static group instead of a dynamic group?
- A. You do not want the group membership to change automatically
- B. You need hosts to be automatically assigned to a group
- C. You are managing more than 1000 hosts
- D. You want the group to contain hosts from multiple operating systems
Answer: A
NEW QUESTION # 86
Which role allows a user to connect to hosts using Real-Time Response?
- A. Real Time Responder - Active Responder
- B. Falcon Administrator
- C. Endpoint Manager
- D. Prevention Hashes Manager
Answer: A
NEW QUESTION # 87
Where should you look to find the history of the successes and failures for any Falcon Fusion workflows?
- A. Custom Alert History
- B. Workflow Execution log
- C. Falcon Ul Audit Trail
- D. Workflow Audit log
Answer: B
Explanation:
Explanation
The place where you can find the history of the successes and failures for any Falcon Fusion workflows is the Workflow Execution log. The Workflow Execution log in the Workflow Management option allows you to view the status and results of workflow executions triggered by detection events. You can filter the log by workflow name, status, start and end time, and detection ID. You can also view the details of each execution, including the actions performed, the output received, and any errors encountered. This log can help you troubleshoot potential failures or issues with your workflows1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 88
Under the "Next-Gen Antivirus: Cloud Machine Learning" setting there are two categories, one of them is
"Cloud Anti-Malware" and the other is:
- A. Advanced Machine Learning
- B. Execution Blocking
- C. Sensor Anti-Malware
- D. Adware & PUP
Answer: D
Explanation:
Explanation
With EDR license, if you go to "Audit logs > Machine-learning prevention monitoring", three options appear:
Cloud Anti-malware, Sensor Anti-malware and Adware&PUP. Therefore, answer is A.
NEW QUESTION # 89
You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?
- A. Auto - TEST-QA
- B. Auto - N-1
- C. Specific sensor version number
- D. Sensor version updates off
Answer: C
Explanation:
Explanation
The administrator can choose a specific sensor version number in the Sensor Update policy to manually control when the sensor version is upgraded or downgraded. This will allow the Falcon Cloud to push out sensor version changes, but only when the administrator changes the version number in the policy. The other options will either automate the sensor version updates or turn them off completely. Reference: [CrowdStrike Falcon User Guide], page 38.
NEW QUESTION # 90
How do you assign a Prevention policy to one or more hosts?
- A. Create a new policy and assign it directly to those hosts on the Host Management page
- B. Create a new policy and assign it directly to those hosts on the Prevention policy page
- C. Modify the users roles on the User Management page
- D. Ensure the hosts are in a group and assign that group to a custom Prevention policy
Answer: D
Explanation:
Explanation
The administrator can assign a Prevention policy to one or more hosts by ensuring the hosts are in a group and assigning that group to a custom Prevention policy. This allows users to apply different prevention settings and options to different groups of hosts based on their needs and preferences. The other options are either incorrect or not applicable to assigning a Prevention policy. Reference: [CrowdStrike Falcon User Guide], page 34.
NEW QUESTION # 91
An analyst has reported they are not receiving workflow triggered notifications in the past few days. Where should you first check for potential failures?
- A. Custom Alert History
- B. Workflow Execution log
- C. Workflow Audit log
- D. Falcon UI Audit Trail
Answer: B
NEW QUESTION # 92
What information does the API Audit Trail Report provide?
- A. A list of specific changes to prevention policy
- B. A list of newly added hosts
- C. A list of actions taken via Falcon OAuth2-based APIs
- D. A list of analyst login activity
Answer: C
Explanation:
Explanation
The information that the API Audit Trail Report provides is a list of actions taken via Falcon OAuth2-based APIs.
The API Audit Trail Report allows you to view and audit the activity and usage of the Falcon APIs by different API clients and users in your organization.
You can use this report to monitor who accessed what data, when, and how via the Falcon APIs2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 93
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20 minute default provisioning window?
- A. ExtendedWindow=1
- B. Timeout=30
- C. Timeout=0
- D. ProvNoWait=1
Answer: B
NEW QUESTION # 94
On a Windows host, what is the best command to determine if the sensor is currently running?
- A. ping falcon.crowdstrike.com
- B. sc query csagent
- C. This cannot be accomplished with a command
- D. netstat -a
Answer: B
Explanation:
Explanation
On a Windows host, the best command to determine if the sensor is currently running is sc query csagent. This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused. If the service is running, the sensor is also running3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 95
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?
- A. Client name
- B. Secret
- C. Base URL
- D. Client ID
Answer: B
Explanation:
Explanation
When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.
Reference: CrowdStrike Falcon User Guide, page 54.
NEW QUESTION # 96
An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?
- A. Each exclusion can be aligned to only one group of hosts
- B. There is a limit of three groups of hosts applied to any exclusion
- C. File exclusions are not aligned to groups or hosts
- D. There is no limit and exclusions can be applied to any or all groups
Answer: B
NEW QUESTION # 97
Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?
- A. Next-Gen Antivirus (NGAV) protection
- B. Adware and Potentially Unwanted Program detection and prevention
- C. Identification and analysis of unknown executables
- D. Real-time offline protection
Answer: C
NEW QUESTION # 98
When the Notify End Users policy setting is turned on, which of the following is TRUE?
- A. End-users receive a pop-up notification when a prevention action occurs
- B. End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist
- C. End users will be immediately notified via a pop-up that their machine is in-network isolation
- D. End users will receive a pop-up allowing them to confirm or refuse a pending quarantine
Answer: A
NEW QUESTION # 99
......
REAL CCFA-200 Exam Questions With 100% Refund Guarantee : https://www.free4torrent.com/CCFA-200-braindumps-torrent.html
Get Special Discount Offer on CCFA-200 Dumps PDF: https://drive.google.com/open?id=1U5DtPoVtL2d61UJh3vM9vWtCnuL3Lx6e