CCFA-200b Exam Question 1

You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?
  • CCFA-200b Exam Question 2

    An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
  • CCFA-200b Exam Question 3

    Detections related to a penetration test on a particular server are currently generating thousands of entries in the console. Your leadership does not need to track the detections in Falcon.
    What should you do to allow your team to focus on more relevant detections?
  • CCFA-200b Exam Question 4

    Certain services are required to be running to install the Windows Falcon sensor. What may cause the LMHost service to be disabled?
  • CCFA-200b Exam Question 5

    An analyst is asked to retrieve an API client secret from a previously generated key. How can they achieve this?