First Attempt Guaranteed Success in CCFA-200 Exam 2024
Real CCFA-200 Exam Questions are the Best Preparation Material
NEW QUESTION # 70
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.
- A. the logon type (e.g. interactive, service)
- B. the account type for the user (e.g. Domain Administrator, Local User)
- C. the last time the user's password was set
- D. all hosts the user logged into
Answer: C
NEW QUESTION # 71
Which of the following best describes the Default Sensor Update policy?
- A. The Default Sensor Update policy does not have the "Uninstall and maintenance protection" feature
- B. The Default Sensor Update policy is only used for testing sensor updates
- C. The Default Sensor Update policy is a "catch-all" policy
- D. The Default Sensor Update policy is disabled by default
Answer: C
Explanation:
Explanation
The Default Sensor Update policy is a "catch-all" policy. This means that any host that is not assigned to a specific sensor update policy will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is enabled by default and has the "Uninstall and maintenance protection" feature turned on. You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 72
What can the Quarantine Manager role do?
- A. Manage roles and users
- B. Manage detection settings
- C. Manage quarantined files to release and download
- D. Manage and change prevention settings
Answer: C
Explanation:
Explanation
The Quarantine Manager role can manage quarantined files to release and download. This role allows users to view and search quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability. Reference: [CrowdStrike Falcon User Guide], page 19.
NEW QUESTION # 73
When a host belongs to more than one host group, how is sensor update precedence determined?
- A. The highest precedence policy from the most important group is applied to the host
- B. All of the host's groups are examined in aggregate and the policy with highest precedence is applied to the host
- C. Sensors of hosts that belong to more than one group must be manually updated
- D. Groups have no impact on sensor update policies
Answer: B
Explanation:
Explanation
The option that describes how sensor update precedence is determined when a host belongs to more than one host group is that all of the host's groups are examined in aggregate and the policy with highest precedence is applied to the host. A Sensor Update policy is a policy that controls how and when the Falcon sensor is updated on a host. You can create and assign custom Sensor Update policies to different hosts or groups in your environment. Each Sensor Update policy has a precedence value, which determines its priority over other policies. The higher the precedence value, the higher the priority. If a host belongs to more than one host group, each with a different Sensor Update policy assigned, then all of the host's groups are examined in aggregate and the policy with highest precedence among them is applied to the host.
References: : [Falcon Administrator Learning Path | Infographic | CrowdStrike]
NEW QUESTION # 74
Which of the following is TRUE of the Logon Activities Report?
- A. It gives a detailed list of all logon activity for users
- B. The report can be filtered by computer name
- C. It only gives a summary of the last logon activity for users
- D. Shows a graphical view of user logon activity and the hosts the user connected to
Answer: C
Explanation:
Explanation
The Logon Activities Report shows a graphical view of user logon activity and the hosts the user connected to, but it only gives a summary of the last logon activity for users. It does not give a detailed list of all logon activity for users, nor can it be filtered by computer name. The other options are either incorrect or not true of the report. Reference: CrowdStrike Falcon User Guide, page 50.
NEW QUESTION # 75
When troubleshooting the Falcon Sensor on Windows, what is the correct parameter to output the log directory to a specified file?
- A. C:\CSSensorlnstall\LogFiles
- B. \log log.txt
- C. LOG=log.txt
- D. /log log.txt
Answer: D
Explanation:
Explanation
The correct parameter to output the log directory to a specified file when troubleshooting the Falcon Sensor on Windows is /log log.txt. This parameter will create a log file named log.txt in the same folder where you run the sensor installation command. The log file will contain information about the sensor installation process, such as the parameters used, the actions performed, and any errors encountered3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 76
What would be the most appropriate action to take if you wanted to prevent a folder from being uploaded to the cloud without disabling uploads globally?
- A. A Custom IOC entry
- B. A Sensor Visibility exclusion
- C. An IOA exclusion
- D. A Machine Learning exclusion
Answer: A
Explanation:
Explanation
The most appropriate action to take if you wanted to prevent a folder from being uploaded to the cloud without disabling uploads globally is to create a Custom IOC entry. A Custom IOC (indicator of compromise) entry allows you to define custom rules for detecting or preventing malicious activity based on file hashes, file paths, IP addresses, or domains. You can use regex (regular expression) syntax to create a Custom IOC entry that matches the folder path that you want to block from being uploaded to the cloud1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 77
Which of the following tools developed by Crowdstrike is intended to help with removal of the CrowdStrike Windows Falcon Sensor?
- A. UninstallTool.exe
- B. FalconUninstall.exe
- C. CrowdStrikeRemovalTool.exe
- D. CSUninstallTool.exe
Answer: D
Explanation:
Explanation
The tool developed by Crowdstrike that is intended to help with removal of the CrowdStrike Windows Falcon Sensor is CSUninstallTool.exe. This tool is a command-line utility that can uninstall the Falcon sensor from a Windows system without requiring user interaction or network connectivity. The tool can also bypass the Uninstall and Maintenance Protection feature if enabled in the Sensor Update Policy2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 78
What is the purpose of a containment policy?
- A. To define which Falcon analysts can contain endpoints
- B. To define the trigger under which a machine is put in Network Containment (e.g. a critical detection)
- C. To define allowed IP addresses over which your hosts will communicate when contained
- D. To define the duration of Network Containment
Answer: B
NEW QUESTION # 79
When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?
- A. Client name
- B. Base URL
- C. Client ID
- D. Secret
Answer: D
Explanation:
Explanation
When creating an API client, the secret must be saved immediately since it cannot be viewed again after the client is created. The secret is a randomly generated string that is used to authenticate the API client along with the client ID. The other options are either incorrect or can be viewed or modified later.
Reference: CrowdStrike Falcon User Guide, page 54.
NEW QUESTION # 80
A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?
- A. There is another analyst connected into it
- B. The host has a user logged into it
- C. They do not have an RTR role assigned to them
- D. The domain controller is preventing the connection
Answer: C
Explanation:
Explanation
The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles: Real Time Response
-Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 81
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?
- A. Sensor version fixed and Uninstall and maintenance protection turned on
- B. Sensor version set to N-1 and Bulk maintenance mode is turned on
- C. Sensor version updates off and Uninstall and maintenance protection turned off
- D. Sensor version set to N-2 and Bulk maintenance mode is turned on
Answer: A
NEW QUESTION # 82
Which command would tell you if a Falcon Sensor was running on a Windows host?
- A. sc.exe query falcon
- B. netstat.exe -f
- C. cswindiag.exe -status
- D. sc.exe query csagent
Answer: D
Explanation:
Explanation
The command that would tell you if a Falcon Sensor was running on a Windows host is sc.exe query csagent.
This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused. If the service is running, the sensor is also running3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 83
You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?
- A. Sensor version updates off
- B. Specific sensor version number
- C. Auto - TEST-QA
- D. Auto - N-1
Answer: B
NEW QUESTION # 84
What will happen to a host if it is not assigned a Sensor Update policy?
- A. The host will use the Default Sensor Update policy
- B. The host will automatically update to the newest sensor version and auto-update to future release
- C. The host will uninstall the Sensor and provide an alert to the installation team
- D. The host will automatically create a custom Sensor Update policy
Answer: A
Explanation:
Explanation
The option that describes what will happen to a host if it is not assigned a Sensor Update policy is that the host will use the Default Sensor Update policy. A Sensor Update policy is a policy that controls how and when the Falcon sensor is updated on a host. You can create and assign custom Sensor Update policies to different hosts or groups in your environment. However, if a host is not assigned to a specific Sensor Update policy, it will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is a "catch-all" policy that is enabled by default and has the "Uninstall and Maintenance Protection" feature turned on. You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 85
In order to quarantine files on the host, what prevention policy settings must be enabled?
- A. Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled
- B. Malware Protection and Custom Execution Blocking must be enabled
- C. Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled
- D. Malware Protection and Windows Anti-Malware Execution Blocking must be enabled
Answer: D
NEW QUESTION # 86
What must an admin do to reset a user's password?
- A. From User Management, select "Update Account" and manually create a new password for the affected user account
- B. From User Management, open the account details for the affected user and select "Generate New Password"
- C. From User Management, select "Reset Password" from the three dot menu for the affected user account
- D. From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid
Answer: C
Explanation:
Explanation
The administrator can reset a user's password by selecting "Reset Password" from the three dot menu for the affected user account in the User Management page. This will generate a new password and send it to the user's email address. The other options are either incorrect or not available. Reference: CrowdStrike Falcon User Guide, page 25.
NEW QUESTION # 87
......
Practice LATEST CCFA-200 Exam Updated 152 Questions: https://www.dumpstorrent.com/CCFA-200-exam-dumps-torrent.html
Download Latest CCFA-200 Dumps with Authentic Real Exam QA's: https://drive.google.com/open?id=12WqPOLFeP6NJj0MecGKH5fqpKp0e0eqy