Which of the following applies to Custom Blocking Prevention Policy settings?

On a Windows host, what is the best command to determine if the sensor is currently running?

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

You want to create a detection-only policy. How do you set this up in your policy's settings?

How long are detection events kept in Falcon?