[Apr-2024] Pass CrowdStrike CCFA-200 Exam in First Attempt Guaranteed!

Full CCFA-200 Practice Test and 152 unique questions with explanations waiting just for you, get it now!

NEW QUESTION # 80
When creating new IOCs in IOC management, which of the following fields must be configured?

• A. Hash, Description, Filename
• B. Hash, Action and Expiry Date
• C. Hash, Platform and Action
• D. Filename, Severity and Expiry Date

Answer: C

Explanation:
Explanation
When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac. The Action field is the action that Falcon will take when detecting the IOC, such as Detect, Block or Allow. The other fields are either optional or not available. Reference: CrowdStrike Falcon User Guide, page 44

NEW QUESTION # 81
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

• A. Clone the workflow and replace the existing email with your CISO's email
• B. Add a sequential action to send a custom email to your CISO
• C. Add the CISO's email to the existing action
• D. Add a parallel action to send a custom email to your CISO

Answer: D

Explanation:
Explanation
The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start. By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

NEW QUESTION # 82
Which is a filter within the Host setup and management > Host management page?

• A. BIOS Version
• B. User name
• C. OU
• D. Locality

Answer: A

NEW QUESTION # 83
The Falcon Administrator has created a new prevention policy to apply to the "Servers" group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?

• A. The "Servers" group already has a policy applied to it
• B. The "Servers" group must be disabled first
• C. Host type was not defined correctly within the prevention policy
• D. The new prevention policy should be enabled first

Answer: A

Explanation:
Explanation
The most likely issue for not being able to apply a new prevention policy to the "Servers" group is that the
"Servers" group already has a policy applied to it. A prevention policy is a policy that defines the prevention capabilities and settings for the Falcon sensor on a host. You can create and assign custom prevention policies to different hosts or groups in your environment. However, you can only assign one prevention policy per host or group at a time. If a host or group already has a prevention policy applied to it, you cannot apply another prevention policy to it unless you remove or replace the existing one2.
References: 2: Cybersecurity Resources | CrowdStrike

NEW QUESTION # 84
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?

• A. Sensor version fixed and Uninstall and maintenance protection turned on
• B. Sensor version set to N-1 and Bulk maintenance mode is turned on
• C. Sensor version set to N-2 and Bulk maintenance mode is turned on
• D. Sensor version updates off and Uninstall and maintenance protection turned off

Answer: A

NEW QUESTION # 85
What best describes the relationship between Sensor Update policies and Operating Systems?

• A. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
• B. Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions
• C. Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies
• D. Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems

Answer: A

Explanation:
Explanation
The option that describes the relationship between Sensor Update policies and Operating Systems is that a Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux). This option is essentially a repetition of question 141 and its answer. Sensor Update policies are specific to each operating system type, as different operating systems have different sensor versions, features, and requirements. Therefore, you need to create and assign separate Sensor Update policies for each operating system type in your environment1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

NEW QUESTION # 86
Why is it important to know your company's event data retention limits in the Falcon platform?

• A. Your query will require you to specify the data pool associated with the date you wish to search
• B. Data such as process records are kept for a shorter time than event data
• C. This is not necessary; you simply select "All Time" in your query to search all data
• D. You will not be able to search event data into the past beyond your retention period

Answer: D

NEW QUESTION # 87
Under which scenario can Sensor Tags be assigned?

• A. While triaging a detection
• B. While managing hosts in the Falcon console
• C. While installing a sensor
• D. While updating a sensor in the Falcon console

Answer: C

Explanation:
Explanation
Check in documentation, there are two kind of tags, the Falcon Grouping Tags that can be managed in falcon console or API and the Sensor Grouping Tags that are configured as parameter in cli, that kind of tags can be diferentiated because it appears with the prefix SensorGroupingTags followed with the name of the tag. If you want to modify a sensor tag is necessary change a registry key value and reboot the device or waiting until the sensor is upgraded.

NEW QUESTION # 88
Which of the following is NOT an available filter on the Hosts Management page?

• A. Group
• B. Hostname
• C. OS Version
• D. Username

Answer: C

NEW QUESTION # 89
The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

• A. Some network configurations, such as deep packet inspection, interfere with certificate validation
• B. HTTPS interception should be enabled to proceed with certificate validation
• C. Common sources of interference with certificate pinning include protocol race conditions and resource contention
• D. SSL inspection should be configured to occur on all Falcon traffic

Answer: A

NEW QUESTION # 90
When would the No Action option be assigned to a hash in IOC Management?

• A. When you want to save the indicator for later action, but do not want to block or allow it at this time
• B. There is no such option as No Action available in the Falcon console
• C. Add the indicator to your blocklist and show it as a detection
• D. Add the indicator to your allowlist and do not detect it

Answer: A

NEW QUESTION # 91
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

• A. Real Time Responder - Script Developer
• B. Real Time Responder - Active Responder
• C. Real Time Responder - Administrator
• D. Real Time Responder - Read Only Analyst

Answer: A

NEW QUESTION # 92
Which of the following is NOT an available filter on the Hosts Management page?

• A. Username
• B. Group
• C. Hostname
• D. OS Version

Answer: A

Explanation:
Explanation
Username is not an available filter on the Hosts Management page. The Hosts Management page allows you to view and manage all the hosts in your environment that have Falcon sensors installed. You can filter the hosts by hostname, group, OS version, sensor version, last seen date, health events, detections, and preventions. You can also perform actions such as assigning hosts to groups, updating sensor policies, uninstalling sensors, or isolating hosts1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

NEW QUESTION # 93
Where do you obtain the Windows sensor installer for CrowdStrike Falcon?

• A. Sensors are downloaded from the Hosts > Sensor Downloads
• B. Sensor installers are unique to each customer and must be obtained from support
• C. Sensor installers are not used because sensors are deployed from within Falcon
• D. Sensor installers are downloaded from the Support section of the CrowdStrike website

Answer: A

Explanation:
Explanation
The Windows sensor installer for CrowdStrike Falcon can be downloaded from the Hosts > Sensor Downloads page in the Falcon console. This page allows you to download different sensor versions and installers for various operating systems and platforms, as well as view installation instructions and release notes. The other options are either incorrect or not available. Reference: CrowdStrike Falcon User Guide, page 27.

NEW QUESTION # 94
Why is the ability to disable detections helpful?

• A. It gives users the ability to remove all data from hosts that have been uninstalled
• B. It gives users the ability to set up hosts to test detections and later remove them from the console
• C. It gives users the ability to uninstall the sensor from a host
• D. It gives users the ability to allowlist a false positive detection

Answer: D

NEW QUESTION # 95
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

• A. Clone the workflow and replace the existing email with your CISO's email
• B. Add a sequential action to send a custom email to your CISO
• C. Add the CISO's email to the existing action
• D. Add a parallel action to send a custom email to your CISO

Answer: B

NEW QUESTION # 96
You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?

• A. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"
• B. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
• C. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"
• D. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.

Answer: D

Explanation:
Explanation
The best way to ensure that a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers are not allowed to run in your environment is to use IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking. This will allow Falcon to block the execution of these hashes on the hosts using this policy. The other options are either incorrect or not efficient to achieve this goal. Reference: [CrowdStrike Falcon User Guide], page 44.

NEW QUESTION # 97
......

Prepare for your CrowdStrike certification with the updated ValidExam CCFA-200 exam questions: https://drive.google.com/open?id=1xNvaUdlV98kfeNCsaVXoZRoAgOwxhGHR

Get Latest CCFA-200 Dumps Exam Questions in here: https://www.validexam.com/CCFA-200-latest-dumps.html