Pass Your CrowdStrike Exam with CCFA-200 Exam Dumps (Updated 152 Questions) [Q61-Q76]

4.7/5 - (3 votes)

Pass Your CrowdStrike Exam with CCFA-200 Exam Dumps (Updated 152 Questions)

CCFA-200 Exam Dumps – CrowdStrike Practice Test Questions

CrowdStrike Falcon platform is known for its advanced endpoint protection capabilities, which rely on artificial intelligence and machine learning technologies to detect and prevent advanced threats. The CCFA-200 certification exam focuses on these technologies, as well as other key aspects of endpoint protection, such as vulnerability management, device control, and data loss prevention.

Q61. An analyst has reported they are not receiving workflow triggered notifications in the past few days. Where should you first check for potential failures?

Custom Alert History

Workflow Execution log

Workflow Audit log

Falcon UI Audit Trail

Explanation
The Workflow Execution log in the Workflow Management option allows you to view the status and results of workflow executions triggered by detection events. You can filter the log by workflow name, status, start and end time, and detection ID. You can also view the details of each execution, including the actions performed, the output received, and any errors encountered. This log can help you troubleshoot potential failures or issues with your workflows1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

Q62. What is the purpose of the Machine-Learning Prevention Monitoring Report?

It is designed to give an administrator a quick overview of machine-learning aggressiveness settings as well as the numbers of items actually quarantined

It is the dashboard used by an analyst to view all items quarantined and to release any items deemed non-malicious

It is the dashboard used to see machine-learning preventions, and it is used to identify spikes in activity and possible targeted attacks

It is designed to show malware that would have been blocked in your environment based on different Machine-Learning Prevention settings

Explanation
Machine-Learning Prevention Monitoring dashboard: Use this dashboard to view malware that would have been blocked in your environment over the selected timeframe based on different Machine Learning Prevention settings (Cautious, Moderate, Aggressive or Extra Aggressive).

Q63. An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

File exclusions are not aligned to groups or hosts

There is a limit of three groups of hosts applied to any exclusion

There is no limit and exclusions can be applied to any or all groups

Each exclusion can be aligned to only one group of hosts

Q64. What type of information is found in the Linux Sensors Dashboard?

Hosts by Kernel Version, Shells spawned by Root, Wget/Curl Usage

Hidden File execution, Execution of file from the trash, Versions Running with Computer Names

Versions running, Directory Made Invisible to Spotlight, Logging/Auditing Referenced, Viewed, or Modified

Private Information Accessed, Archiving Tools – Exfil, Files Made Executable

Q65. After Network Containing a host, your Incident Response team states they are unable to remotely connect to the host. Which of the following would need to be configured to allow remote connections from specified IP’s?

Response Policy

Containment Policy

Maintenance Token

IP Allowlist Management

Explanation
The option that would need to be configured to allow remote connections from specified IP’s after network containing a host is IP Allowlist Management. IP Allowlist Management allows you to define a list of trusted IP addresses that can communicate with your contained hosts. This way, you can isolate a host from the network while still allowing your incident response team or other authorized parties to remotely connect to the host for investigation or remediation purposes2.
References: 2: Cybersecurity Resources | CrowdStrike

Q66. The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.

the account type for the user (e.g. Domain Administrator, Local User)

all hosts the user logged into

the logon type (e.g. interactive, service)

the last time the user’s password was set

Q67. The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?

Policy alignment is configured in the “Host Management” section in the Hosts application

Policy alignment is configured only once during the initial creation of the policy in the “Create New Policy” pop-up window

Policy alignment is configured in the General Settings section under the Configuration menu

Policy alignment is configured in each policy in the “Assigned Host Groups” tab

Q68. In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?

Sensor version set to N-1 and Bulk maintenance mode is turned on

Sensor version fixed and Uninstall and maintenance protection turned on

Sensor version updates off and Uninstall and maintenance protection turned off

Sensor version set to N-2 and Bulk maintenance mode is turned on

Q69. What is the function of a single asterisk (*) in an ML exclusion pattern?

The single asterisk will match any number of characters, including none. It does include separator characters, such as or /, which separate portions of a file path

The single asterisk will match any number of characters, including none. It does not include separator characters, such as or /, which separate portions of a file path

The single asterisk is the insertion point for the variable list that follows the path

The single asterisk is only used to start an expression, and it represents the drive letter

Q70. Which of the following best describes the Default Sensor Update policy?

The Default Sensor Update policy does not have the “Uninstall and maintenance protection” feature

The Default Sensor Update policy is only used for testing sensor updates

The Default Sensor Update policy is a “catch-all” policy

The Default Sensor Update policy is disabled by default

Explanation
The Default Sensor Update policy is a “catch-all” policy. This means that any host that is not assigned to a specific sensor update policy will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is enabled by default and has the “Uninstall and maintenance protection” feature turned on. You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it2.
References: 2: Cybersecurity Resources | CrowdStrike

Q71. What can exclusions be applied to?

Individual hosts selected by the administrator

Either all hosts or specified groups

Only the default host group

Only the groups selected by the administrator

Explanation
The option that describes what exclusions can be applied to is that exclusions can be applied to either all hosts or specified groups. An exclusion is a rule that defines what files, folders, processes, IP addresses, or domains should be excluded from detection or prevention by the Falcon sensor. You can create and manage exclusions in the Exclusions page in the Falcon console. You can apply exclusions to either all hosts in your environment or to specific host groups that you select. You cannot apply exclusions to individual hosts selected by the administrator.
References: : [Cybersecurity Resources | CrowdStrike]

Q72. Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

Falcon NGAV relies on signature-based detections

Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy

The Detection sliders cannot be set to a value less aggressive than the Prevention sliders

Falcon NGAV is not a replacement for Windows Defender or other antivirus programs

Q73. What impact does disabling detections on a host have on an API?

Endpoints with detections disabled will not alert on anything until detections are enabled again

Endpoints cannot have their detections disabled individually

DetectionSummaryEvent stops sending to the Streaming API for that host

Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

Explanation
Disabling detections on a host will stop the DetectionSummaryEvent from sending to the Streaming API for that host. This means that the host will not send any detection events to the Streaming API, which is used to stream data from the Falcon Cloud to external applications or systems. The other options are either incorrect or not related to disabling detections on a host. Reference: [CrowdStrike Falcon User Guide], page 32.

Q74. Which of the following is NOT an available filter on the Hosts Management page?

Hostname

Username

Group

OS Version

Q75. What is the maximum number of patterns that can be added when creating a new exclusion?

Q76. On the Host management page which filter could be used to quickly identify all devices categorized as a
“Workstation” by the Falcon Platform?

Status

Platform

Hostname

Type

Explanation
The filter that could be used to quickly identify all devices categorized as a “Workstation” by the Falcon Platform on the Host Management page is Type. The Type filter allows you to filter hosts by their device type, such as workstation, server, or domain controller. The device type is assigned to each host based on their Active Directory domain structure. You can use the Type filter to quickly identify all hosts that have the workstation type assigned in their domain2.
References: 2: Cybersecurity Resources | CrowdStrike

Loading …

The CrowdStrike CCFA-200 exam covers a wide range of topics, including the basics of the CrowdStrike Falcon platform, its architecture, and its deployment options. It also covers advanced topics such as threat hunting, incident response, and the use of the CrowdStrike Falcon APIs. Candidates will be evaluated on their understanding of the platform’s essential features, as well as their ability to configure and manage the platform to meet specific security needs.

Pass Your CCFA-200 Exam Easily with Accurate PDF Questions: https://www.braindumpstudy.com/CCFA-200_braindumps.html