CCFA Practice Test

CCFA Practice Test practice questions, page 4 of 10, with answer review and explanations.

Question 16

What is the goal of a Network Containment Policy?

  1. Increase the aggressiveness of the assigned prevention policy
  2. Limit the impact of a compromised host on the network
  3. Gain more visibility into network activities
  4. Partition a network for privacy

Question 17

Which of the following applies to Custom Blocking Prevention Policy settings?

  1. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
  2. Blocklisting applies to hashes, IP addresses, and domains
  3. Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
  4. You can only blocklist hashes via the API

Question 18

How many "Auto" sensor version update options are available for Windows Sensor Update Policies?

  1. 1
  2. 2
  3. 0
  4. 3

Question 19

The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?

  1. Policy alignment is configured in the "Host Management" section in the Hosts application
  2. Policy alignment is configured only once during the initial creation of the policy in the "Create New Policy" pop-up window
  3. Policy alignment is configured in the General Settings section under the Configuration menu
  4. Policy alignment is configured in each policy in the "Assigned Host Groups" tab

Question 20

How long are detection events kept in Falcon?

  1. Detection events are kept for 90 days
  2. Detections events are kept for your subscribed data retention period
  3. Detection events are kept for 7 days
  4. Detection events are kept for 30 days