CCFR-201b Exam Question 26

The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?
  • CCFR-201b Exam Question 27

    Which of the following is NOT a valid event type?
  • CCFR-201b Exam Question 28

    Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?
  • CCFR-201b Exam Question 29

    If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?
  • CCFR-201b Exam Question 30

    When viewing the main 'Quarantine' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?