최신 CCFA-200b 무료덤프 - CrowdStrike Certified Falcon Administrator

문제1

After enabling an IOA rule and its respective rule group, what else must be done for an IOA to be fully functional?

A. The rule group must be assigned to a prevention policy

B. The rule must be manually triggered

C. Hosts must be individually selected to apply to the rule

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제2

To improve the organization's security posture, you are designing a Fusion SOAR workflow to generate an alert when critical vulnerabilities are detected by Falcon. When creating a new workflow from scratch, what component of the workflow must be configured first?

A. Condition

B. Action

C. Trigger

D. Workflow Name

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

문제3

You are tasked with creating a group for hosts running Windows 10. What kind of group should you create to make sure all applicable hosts are included in your environment?

A. Create a dynamic group with the assignment rule criteria for OS Version set to Windows 10

B. Create a dynamic group with the assignment rule criteria set to OS Type Workstation

C. Create a static group with the assignment rule criteria set to OS Type Workstation

D. Create a static group with the assignment rule criteria for OS Version set to Windows 10

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제4

Which role allows a Falcon user to create Real Time Response Custom Scripts?

A. Real Time Responder - Administrator

B. Real Time Responder - Active Responder

C. Real Time Responder - Script Developer

D. Real Time Responder - Read Only Analyst

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제5

What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode?

A. RFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon

B. RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console

C. RFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled

D. RFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

문제6

An inactive host does not contact the Falcon cloud. What is the default number of days after which it is automatically removed from the Host Management page?

A. 45 Days

B. 90 Days

C. 30 Days

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제7

What least privilege role should be given to a user who needs to extract files with RTR?

A. Real Time Responder - Administrator

B. Real Time Responder - Active Responder

C. Falcon Security Lead

D. Falcon Investigator

정답: B

문제8

You will be testing detections with pentest and security tooling on your host. How can a workflow be created to automatically assign any detection related to your pentest to yourself in real time?

A. Create an Event trigger workflow that triggers on an EPP Detection with conditions looking for the desired hostname

B. Create an alert on usage of the tools and assign the alerts to you automatically via workflow

C. Create an IOC for the host to trigger associated detections and assign them to you via workflow

D. Create an Event trigger workflow that triggers on an EPP Detection with an action to assign the detection to yourself

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제9

In addition to Host Groups, what other groups can a prevention policy be applied to?

A. Custom IOA Rule Groups

B. Machine Learning Groups

C. Custom IOC Groups

D. Operating System Groups

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제10

A host has been Network contained with Falcon and you have been asked to update the Operating System with zero day patches. You have tried using your patch update systems for this task, but the jobs fail. Which configuration steps in the Falcon UI will allow these activities?

A. Create a Containment Policy that allow lists the Fully Qualified name of your patch management tools

B. Create a Firewall Policy that allow lists your patch management tools

C. Create a Containment Policy that allow lists the specific IP addresses of your patch management tools

D. Remove Host containment and update the host with all patches

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

최신 CCFA-200b 무료덤프 - CrowdStrike Certified Falcon Administrator - 2024 Version

우리와 연락하기

유용한 링크

최신 업데이트