Online Access Free CCFA-200b Exam Questions

Detections related to a penetration test on a particular server are currently generating thousands of entries in the console. Your leadership does not need to track the detections in Falcon. What should you do to allow your team to focus on more relevant detections?

• A.Permanently disable detections for the server in Host Management
• B.Temporarily disable detections for the server in Host Management and reenable after the test is done
• C.Delete the detections in the console and contain the server undergoing the test
• D.Create a Fusion Workflow to email the SOC team every time the penetration test generates a detection

You will be testing detections with pentest and security tooling on your host. How can a workflow be created to automatically assign any detection related to your pentest to yourself in real time?

• A.Create an alert on usage of the tools and assign the alerts to you automatically via workflow
• B.Create an Event trigger workflow that triggers on an EPP Detection with an action to assign the detection to yourself
• C.Create an IOC for the host to trigger associated detections and assign them to you via workflow
• D.Create an Event trigger workflow that triggers on an EPP Detection with conditions looking for the desired hostname

A Falcon Administrator is unable to initiate a Real-Time Response (RTR) session. What is the most likely cause?

• A.The host has a user logged into it
• B.There is another analyst connected into it
• C.The domain controller is preventing the connection
• D.They do not have an RTR role assigned to them

You need to be aware of which policies are the most used as new hosts are being added to your CID. Where will you find a review of the top-ten sensor update, prevention, and device control policies?

• A.Sensor Policy Daily report
• B.Executive Summary
• C.Managed Assets dashboard

When installing the Falcon Sensor manually on Microsoft Windows, where is the installation log data stored?

• A.%LOCALAPPDATA%\Logs
• B.%SYSTEMROOT%\Logs
• C.%LOCALAPPDATA%\Temp
• D.%SYSTEMROOT%\Temp