Ccfa questions - Study guides, Class notes & Summaries

How do you Add a user? (How do you traverse through the UI to add a user) - ANSWER * ADMINISTRATIVE role for your Falcon subscription, such as FALCON ADMINISTRATOR is required * - Host setup and management > Falcon users > User management. - Click Add User in the upper right of the window. - Enter users email address, first name, last name. - Select one or more roles. - Click Add User

What is the recommended deployment method when deploying a Crowdstrike Falcon sensors across a large umber of endpoints? A) Silent command line installation B) Manual GUI installation C) Attended command line installation D) Manual GUI installation in bulk mode - ANSWER A)Silent command line installation

hat are the sensor update best practices? - ANSWER 1. Update host sensors monthly, or do not let them age past 60 days 2. Create policy for most hosts with "Uninstall and maintenance protection" enabled 3. Create one policy used for handling sensor uninstallation and maintenance, move hosts into this group for uninstallation and maintenance What is the Auto - TEST-QA sensor update policy? - ANSWER When a scheduled release happens, hosts with this sensor update policy updates to the newes...

When uninstalling or removing a sensor, which of the following is required if the "Uninstall and maintenance protection" setting is enabled within the Sensor Update Policies? - ANSWER Maintenance token What is the correct purpose of a sensor visibility exclusion? - ANSWER To remediate issues where the Falcon sensor may cause a performance or application compatibility interaction by configuring the sensor to completely ignore a target path or process

Explain what information is contained in Machine-Learning Prevention Monitoring Report - ANSWER View malware that would have been blocked in your environment during the last 30 days based on different ML Prevention settings (i.e. Cautious, Moderate, or Aggressive) Explain what information is in the Falcon UI Audit Trail Report - ANSWER Activity by Analysts - New User Report - Top Users Granting Access - Audit Details for Analyst

When uninstalling or removing a sensor, which of the following is required if the "Uninstall and maintenance protection" setting is enabled within the Sensor Update Policies? - ANSWER Maintenance token What is the correct purpose of a sensor visibility exclusion? - ANSWER To remediate issues where the Falcon sensor may cause a performance or application compatibility interaction by configuring the sensor to completely ignore a target path or process

How long are inactive sensors retained for in the Host Management Page and visible in the inactive sensors page? : 45 Days What happens when you undo a release from quarantine? : The Falcon sensor treats the file as malicious again. The next time the file attempts to execute, the sensor blocks and quarantines it again. What is IOC Management used for? : To allowlist executables as a compensating control for false positives or to reduce noise. Where can you locate a list of MacOS host...

Stack effect - ANSWER Phenomenon of a strong air draft moving from ground level to the roof level of a building. Affected by building height, configuration, and temperature differences between inside and outside air. Staging Area - ANSWER Prearranged, temporary strategic location, away from the emergency scene, where units assemble and wait until they are assigned a position on the emergency scene.

What is the purpose of the "Auto - Latest" setting in a sensor update policy? - ANSWER This setting will cause all assigned endpoints to be updated to the most current supported sensor version as soon as it becomes available How do you change your own password in the Falcon console if you're not using single sign-on? - ANSWER After logging in, go to the User Profile settings and click the Change Password link. Then supply your current and new passwords

What is the function of a single asterisk (*) in an ML exclusion pattern? A. The single asterisk will match any number of characters, including none. It does include separator characters, such as or /, which separate portions of a file path B. The single asterisk will match any number of characters, including none. It does not include separator characters, such as or /, which separate portions of a file path C. The single asterisk is the insertion point for the variable list that foll...