CCFA Practice Test

CCFA Practice Test practice questions, page 7 of 10, with answer review and explanations.

Question 31

You want to create a detection-only policy. How do you set this up in your policy's settings?

  1. Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.
  2. Select the "Detect-Only" template. Disable hash blocking and exclusions.
  3. You can't create a policy that detects but does not prevent. Use Custom IOA rules to detect.
  4. Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.

Question 32

Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?

  1. .*badguydomain\.com.*
  2. \Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill
  3. badguydomain\.com.*
  4. Custom IOA rules cannot be created for domains

Question 33

Where can you modify settings to permit certain traffic during a containment period?

  1. Prevention Policy
  2. Host Settings
  3. Containment Policy
  4. Firewall Settings

Question 34

Which option allows you to exclude behavioral detections from the detections page?

  1. Machine Learning Exclusion
  2. IOA Exclusion
  3. IOC Exclusion
  4. Sensor Visibility Exclusion

Question 35

What are custom alerts based on?

  1. Custom workflows
  2. Custom event based triggers
  3. Predefined alert templates
  4. User defined Splunk queries