CCFA-200b

CCFA-200b practice questions, page 2 of 3, with answer review and explanations.

Question 6

What page provides a count of new Reduced Functionality Mode (RFM) sensors by day?

  1. Hosts Overview
  2. Sensor Health
  3. Activity Overview
  4. Support and resources

Question 7

Which report would show you an overview of the top ten most-applied policies by sensors in your environment?

  1. Scheduled reports
  2. Sensor report dashboard
  3. Executive summary
  4. Sensor policy daily report

Question 8

What could cause your Windows host to be in Reduced Functionality Mode (RFM)?

  1. CrowdStrike has not certified the latest Windows update
  2. A sensor update policy was misconfigured
  3. A misconfiguration in your prevention policy
  4. The host lost internet connectivity

Question 9

Where can you find the history of the successes and failures for any Fusion SOAR workflows?

  1. Falcon UI Audit Trail
  2. Custom Alert History
  3. Workflow Audit log
  4. Workflow Execution log

Question 10

What is the purpose of the Machine-Learning Prevention Monitoring Audit Log?

  1. It is the dashboard used by an analyst to view all items quarantined and to release any items deemed non-malicious
  2. It is the dashboard used to see machine-learning preventions, and it is used to identify spikes in activity and possible targeted attacks
  3. It is designed to show malicious processes that would have been blocked in your environment based on different Machine-Learning Prevention settings
  4. It is designed to give an administrator a quick overview of machine-learning aggressiveness settings as well as the numbers of items actually quarantined