CCFA-200b試験無料問題集（102題）「CrowdStrike Certified Falcon Administrator

出題：1

Your incident responder team is migrating existing workflows into Fusion SOAR workflows so that they execute natively in Falcon. The workflow imports are failing. What format must the workflows be in order to successfully import them into Fusion SOAR?

A. SOAR

B. CSV

C. YAML

D. JSON

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

Where can you find hosts that have been offline for ten minutes or longer?

A. Host Management

B. Sensor Coverage Dashboard

C. Host Groups

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

What are the components that must be allowed to manually install Falcon Sensor on macOS?

A. Full Disk Access and System extension only

B. System extension, Full Disk Access, and Network filter extension

C. Network filter extension and System extension only

D. Network filter extension and Full Disk Access only

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

A member of your SECOPS team is building custom scripts for RTR, but they are unable to save or share them in Falcon. What additional role do they need?

A. Real Time Response - Administrator

B. Falcon Scripts Manager

C. Workflow Author

D. Real Time Response - Active Responder

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

What happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?

A. All detection data for the host is deleted and the host is hidden from view

B. New detections are disabled for 30 days

C. Existing detections for the host remain

D. The detections for the host are removed from the console immediately

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

In order to receive the most stable sensor updates, what level of automatic sensor updates should be applied to a host?

A. Auto-N-2

B. Auto-N-1

C. Pinned sensor version

D. Auto-Latest

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

You are deploying the Falcon sensor to 500 hosts. Hosts in an Organizational Unit need a specific exclusion that was previously identified. This OU is expected to add members over the next quarter. What is the best way to create a host group for this OU?

A. Create a dynamic group with an assignment rule that excludes the OU

B. Create a dynamic group with an assignment rule that filters for the OU

C. Create a Dynamic Group targeting Windows 10 OS in the domain

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

You will be testing detections with pentest and security tooling on your host. How can a workflow be created to automatically assign any detection related to your pentest to yourself in real time?

A. Create an alert on usage of the tools and assign the alerts to you automatically via workflow

B. Create an Event trigger workflow that triggers on an EPP Detection with conditions looking for the desired hostname

C. Create an IOC for the host to trigger associated detections and assign them to you via workflow

D. Create an Event trigger workflow that triggers on an EPP Detection with an action to assign the detection to yourself

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

A Falcon Administrator is unable to initiate a Real-Time Response (RTR) session. What is the most likely cause?

A. The domain controller is preventing the connection

B. They do not have an RTR role assigned to them

C. There is another analyst connected into it

D. The host has a user logged into it

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

CCFA-200b試験無料問題集「CrowdStrike Certified Falcon Administrator - 2024 Version 認定」