CrowdStrike CCFA-200b Dumps in PDF and Online

QUESTION: 1

What is the function of a single asterisk (*) in an ML exclusion pattern?

The single asterisk will match any number of characters, including none. It does include separator characters, such as \ or /, which separate portions of a file path
The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path
The single asterisk is the insertion point for the variable list that follows the path
The single asterisk is only used to start an expression, and it represents the drive letter

Answer(s): B

Explanation:

The asterisk is a wildcard character that can be used in exclusion patterns to match any number of characters. However, it does not match separator characters, such as \ or /, which are used to separate portions of a file path. For example, the pattern C:\Windows\*\*.exe will match any executable file in any subfolder of the Windows folder, but not in the Windows folder itself. Reference:
Falcon Administrator Learning Path | Infographic | CrowdStrike https://docs.microsoft.com/en-us/azure/machine-learning

Reveal Solution Next Question

QUESTION: 2

You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints.
What is the best way to prevent these in the future?

Contact support and request that they modify the Machine Learning settings to no longer include this detection
Using IOC Management, add the hash of the binary in question and set the action to "Allow"
Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
Using IOC Management, add the hash of the binary in question and set the action to "No Action"

Answer(s): B

Explanation:

to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.

Reveal Solution Next Question

QUESTION: 3

What is the purpose of a containment policy?

To define which Falcon analysts can contain endpoints
To define the duration of Network Containment
To define the trigger under which a machine is put in Network Containment (e.g. a critical detection)
To define allowed IP addresses over which your hosts will communicate when contained

Answer(s): D

Explanation:

In the Containment Policy page have the title "Network traffic allowlist" and it only allows to add IPs or CIDR networks to exclude in the moment of the isolation of any host, because it is a global policy, not allowing make distinctions between machines.

Reveal Solution Next Question

QUESTION: 4

An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

File exclusions are not aligned to groups or hosts
There is a limit of three groups of hosts applied to any exclusion
There is no limit and exclusions can be applied to any or all groups
Each exclusion can be aligned to only one group of hosts

Answer(s): C

Explanation:

An exclusion is a rule that tells the Falcon platform to ignore certain files, folders, processes, or registry keys when performing prevention or detection actions. An administrator can create an exclusion and apply it to one or more groups of hosts, or to all hosts in the organization. For example, an administrator can create an exclusion for a legitimate application that is causing false positives and apply it to the group of hosts that are running that application.

Reference:

Falcon Administrator Learning Path | Infographic | CrowdStrike

Reveal Solution Next Question

QUESTION: 5

Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host.
Which role do you need added to your user account to have this capability?

Real Time Responder
Endpoint Manager
Falcon Investigator
Remediation Manager

Answer(s): A

Explanation:

The Real Time Responder role allows users to use the “Connect to Host” feature to gather additional information from the host, such as running processes, registry keys, files, etc. The other roles do not have this capability.

Reference:

CrowdStrike Falcon User Guide, page 18.

Reveal Solution Next Question

QUESTION: 6

What must an admin do to reset a user's password?

From User Management, open the account details for the affected user and select "Generate New Password"
From User Management, select "Reset Password" from the three dot menu for the affected user account
From User Management, select "Update Account" and manually create a new password for the affected user account
From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid

Answer(s): B

Explanation:

The administrator can reset a user’s password by selecting “Reset Password” from the three dot menu for the affected user account in the User Management page. This will generate a new password and send it to the user’s email address. The other options are either incorrect or not available.

Reference:

CrowdStrike Falcon User Guide, page 25.

Reveal Solution Next Question

QUESTION: 7

Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group.
What is the next step to disable RTR only on these hosts?

Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"

Answer(s): C

Explanation:

The administrator can create a new Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result.

Reference:

CrowdStrike Falcon User Guide, page 35.

Reveal Solution Next Question

QUESTION: 8

When creating new IOCs in IOC management, which of the following fields must be configured?

Hash, Description, Filename
Hash, Action and Expiry Date
Filename, Severity and Expiry Date
Hash, Platform and Action

Answer(s): D

Explanation:

When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac. The Action field is the action that Falcon will take when detecting the IOC, such as Detect, Block or Allow. The other fields are either optional or not available.

Reference:

CrowdStrike Falcon User Guide, page 44

Reveal Solution Next Question

CrowdStrike Certified Falcon Administrator CCFA-200b Dumps in PDF

Free CrowdStrike CCFA-200b Real Questions (page: 1)

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

Reference:

QUESTION: 5

Explanation:

Reference:

QUESTION: 6

Explanation:

Reference:

QUESTION: 7

Explanation:

Reference:

QUESTION: 8

Explanation:

Reference: