CCFA-200b

Review 60 CCFA-200B practice questions with answer explanations and community insights.

Question 1

Where would you apply a configuration to allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained?

  1. IP Allowlist Management
  2. Containment Policy
  3. Response Policies
  4. Maintenance Token

Question 2

An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?

  1. 75 Days
  2. 60 Days
  3. 90 Days
  4. 45 Days

Question 3

What prevention policy setting prevents sensor-related files, folders, and registry objects from being renamed or deleted?

  1. Host Modification Protection
  2. System Configuration Protection
  3. Sensor Tampering Protection
  4. Sensor Modification Protection

Question 4

There are a significant number of false positive detections from your developers that are getting blocked and quarantined by Falcon. What Indicator of Compromise (IOC) action would be the best option?

  1. No_action (displayed as None in the console)
  2. Prevent (displayed as Blocked in the console)
  3. Detect Only (displayed as Detect only in the console)
  4. Allow (displayed as Allow in the console)

Question 5

During a Windows system investigation via Real Time Response (RTR), and RTR Active Responder is unable to execute a custom powershell script for finding specific system artifacts. What is likely restricting the responder from executing the powershell script?

  1. Custom Scripts is not enabled in the response policy
  2. Put-and-Run is not enabled in the response policy
  3. The responder requires the RTR Administrator role
  4. Script-Based Execution Monitoring is not enabled in the response policy
We are moving to a new platform

CertificationTest is being migrated. Some pages may be slow or briefly unavailable; everything will be back to normal within a few hours. If you run into any issue, email support@certificationtest.net.