Falcon Administrator CCFA-200 Practice Questions & Answers • ExamPrepare

33 questions in this view

Page 1 of 6

Question 1

How much experience do you have as a Falcon Administrator?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

How closely did the questions on the exam align to your experience as a Falcon Administrator?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Within the Host setup and management menu, which option provides the number of contained hosts?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Your leadership wants controls in place for immediate action on any Overwatch detections.

What should you do to ensure the host is contained quickly and notifies the appropriate staff?

Create a Fusion SOAR workflow using the Overwatch playbook to contain the host and email the SOC team
Create a Fusion SOAR workflow to create a detection for Overwatch and email the SOC team
Create a Fusion SOAR workflow to contain the host and email the Overwatch team
Create a Fusion SOAR workflow to trigger on an Overwatch detection and set it to block the detection

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

What are all the components that must be allowed to manually install Falcon Sensor on macOS?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

You have 100 hashes that have been prohibited by management and need to be blocked within your organization.

Using Falcon, what is the best way to accomplish this?

Navigate to Configure > IOC Management. Inside this dashboard, add a custom IOC. Add the list of hashes. Set the action to Block. Verify the prevention policy includes Custom Blocking under Execution Blocking.
Navigate to Configure > IOC Management. Inside this dashboard, add a custom Prevention Policy. Add the list of hashes. Set the action to Block. Verify the policy includes Custom Execution Blocking.
Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as a CSV file. Set the action to Block and Alert. Verify the option for Custom Blocking inside Execution Blocking is active.
Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block. Verify the option for Custom Execution Blocking is active.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.