CCFA Practice Test

CCFA Practice Test practice questions, page 10 of 10, with answer review and explanations.

Question 46

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

  1. Configure a Real Time Response policy allowlist with the specific IP addresses
  2. Configure a Containment Policy with the specific IP addresses
  3. Configure a Containment Policy with the entire internal IP CIDR block
  4. Configure the Host firewall to allowlist the specific IP addresses

Question 47

Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

  1. Falcon NGAV relies on signature-based detections
  2. Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy
  3. The Detection sliders cannot be set to a value less aggressive than the Prevention sliders
  4. Falcon NGAV is not a replacement for Windows Defender or other antivirus programs

Question 48

What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

  1. To group hosts with others in the same business unit
  2. To group hosts according to the order in which Falcon was installed, so that updates are installed in the same order every time
  3. To prioritize the order in which Falcon updates are installed, so that updates are not installed all at once leading to network congestion
  4. To allow the controlled assignment of sensor versions onto specific hosts

Question 49

What impact does disabling detections on a host have on an API?

  1. Endpoints with detections disabled will not alert on anything until detections are enabled again
  2. Endpoints cannot have their detections disabled individually
  3. DetectionSummaryEvent stops sending to the Streaming API for that host
  4. Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed