Practice on 2024 LATEST CCFA-200 Exam Updated 152 Questions [Q50-Q68]

NEW QUESTION 50
How many “Auto” sensor version update options are available for Windows Sensor Update Policies?

NEW QUESTION 51
How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

NEW QUESTION 52
How do you find a list of inactive sensors?

NEW QUESTION 53
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?

NEW QUESTION 54
What impact does disabling detections on a host have on an API?

NEW QUESTION 55
Where can you modify settings to permit certain traffic during a containment period?

NEW QUESTION 56
Which of the following is a valid step when troubleshooting sensor installation failure?

NEW QUESTION 57
Which statement describes what is recommended for the Default Sensor Update policy?

NEW QUESTION 58
Which role allows a user to connect to hosts using Real-Time Response?

NEW QUESTION 59
One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called “devcode.” What setting can you use to reduce false positives on this file path?

NEW QUESTION 60
Which is the correct order for manually installing a Falcon Package on a macOS system?

NEW QUESTION 61
On which page of the Falcon console would you create sensor groups?

NEW QUESTION 62
What is the primary purpose of using glob syntax in an exclusion?

NEW QUESTION 63
Even though you are a Falcon Administrator, you discover you are unable to use the “Connect to Host” feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

NEW QUESTION 64
A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

NEW QUESTION 65
Why is it important to know your company’s event data retention limits in the Falcon platform?

NEW QUESTION 66
Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

NEW QUESTION 67
One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called “devcode.” What setting can you use to reduce false positives on this file path?

NEW QUESTION 68
You have been asked to troubleshoot why Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host. Which report can be used to determine if this is an issue with an old prevention policy?