최신CrowdStrike Certified Falcon Administrator - CCFA-200무료샘플문제

A. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"

B. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running

C. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"

D. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.

A. The single asterisk is the insertion point for the variable list that follows the path

B. The single asterisk will match any number of characters, including none. It does include separator characters, such as \ or /, which separate portions of a file path

C. The single asterisk is only used to start an expression, and it represents the drive letter

D. The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path

A. Falcon Host Security Lead

B. Falcon Host Administrator

C. Falcon Host Analyst

D. Prevention Hashes Manager

A. Shows a graphical view of user logon activity and the hosts the user connected to

B. The report can be filtered by computer name

C. It gives a detailed list of all logon activity for users

D. It only gives a summary of the last logon activity for users

A. Create a Static Group with Type=Workstation Assignment

B. Create a Dynamic Group with Type=Workstation Assignment

C. Create a Dynamic Group and Import All Workstations

D. Create a Static Group and Import all Workstations

A. Detections Exceptions Manager

B. Endpoint Manager

C. Falcon Security Lead

D. Falcon Analyst - Read Only

A. All parts of the exclusion can be changed

B. Only the selected groups and hosts to which the exclusion is applied can be changed

C. The exclusion pattern cannot be changed

D. Only the options to "Detect/Block" and/or "File Extraction" can be changed

A. Some detection patterns and preventions will not be triggered

B. System monitoring will be unavailable

C. Prevention patterns will not be triggered

D. Event reporting will be unavailable

A. The host lost internet connectivity

B. A misconfiguration in your prevention policy for the host

C. Microsoft updates altering the kernel

D. A Sensor Update Policy was misconfigured

A. Using IOC management, import the list of hashes and IP addresses and set the action to No Action

B. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only

C. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead

D. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block