Which role allows a user to connect to hosts using Real-Time Response?
Answer(s): C
The role that allows a user to connect to hosts using Real-Time Response is Real Time Responder – Active Responder. This role allows users to use the “Connect to Host” feature to gather additional information from the host, as well as execute commands and scripts on the host. The other roles do not have this capability.
[CrowdStrike Falcon User Guide], page 18.
You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20-minute default provisioning window?
"ProvNoWait=1 The sensor does not abort installation if it can't connect to the CrowdStrike cloud within 20 minutes (10 minutes, in Falcon sensor version 6.21 and earlier). (By default, if the host can't contact our cloud, it will retry the connection for 20 minutes. After that, the host will automatically uninstall its sensor.)""ProvWaitTime=3600000 The sensor waits for 1 hour to connect to the CrowdStrike cloud when installing (the default is 20 minutes)."
How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?
The administrator can find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days by going to Host setup and management > Managed endpoints > Inactive Sensors. Then, change the time range to 30 days. This will show the host name, last seen date, sensor version and group name for each inactive host. The other options are either incorrect or not available.
[CrowdStrike Falcon User Guide], page 31.
In order to quarantine files on the host, what prevention policy settings must be enabled?
Answer(s): B
In order to quarantine files on the host, the administrator must enable the Next-Gen Antivirus Prevention sliders and “Quarantine & Security Center Registration” in the prevention policy settings. This will allow Falcon to quarantine malicious files and register them with Windows Security Center. The other options are either incorrect or not sufficient to enable quarantine.
[CrowdStrike Falcon User Guide], page 36.
Why is it critical to have separate sensor update policies for Windows/Mac/*nix?
Answer(s): A
https://www.crowdstrike.com/blog/tech-center/how-to-manage-policies-in-falcon/
How do you assign a policy to a specific group of hosts?
The administrator can assign a policy to a specific group of hosts by creating a group containing the desired hosts using “Static Assignment.” Then, go to the Assigned Host Groups tab of the desired policy and click “Add groups to policy.” Select the desired Group(s). This will apply the policy to the selected group(s) of hosts. The other options are either incorrect or not applicable to static assignment.
[CrowdStrike Falcon User Guide], page 33.
You want to create a detection-only policy. How do you set this up in your policy's settings?
Answer(s): D
The administrator can create a detection-only policy by setting the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled in the policy’s settings. This will allow Falcon to detect but not prevent threats on the hosts using this policy. Do not activate any of the other blocking or malware prevention options, as they will enable prevention actions. The other options are either incorrect or not related to creating a detection-only policy.
[CrowdStrike Falcon User Guide], page 35.
Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?
You are usuing RegEx here and need leading ".*" to capture www and then need a ".*" at the end to identify any sites falling under badguydomain.com
Share your comments for CrowdStrike CCFA-200b exam with other users:
preparing for this exam is overwhelming. you cannot pass without the help of these exam dumps.
new to this site but i feel it is good
the correct answer to q8 is b. explanation since the mule app has a dependency, it is necessary to include project modules and dependencies to make sure the app will run successfully on the runtime on any other machine. source code of the component that the mule app is dependent of does not need to be included in the exported jar file, because the source code is not being used while executing an app. compiled code is being used instead.
good questions
Delayed the exam until December 29th.
A and D are True
good one with explanation
This is one of the most useful study guides I have ever used.
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your CCFA-200b, please sign in or create a free account.