Online Access Free CCFA-200 Practice Test

You want to create a detection-only policy. How do you set this up in your policy's settings?

• A.Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.
• B.You can't create a policy that detects but does not prevent. Use Custom IOA rules to detect.
• C.Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.
• D.Select the "Detect-Only" template. Disable hash blocking and exclusions.

What command should be run to verify if a Windows sensor is running?

• A.netstat -f
• B.regedit myfile.reg
• C.sc query csagent
• D.ps -ef | grep falcon

The Customer ID (CID) is important in which of the following scenarios?

• A.When performing a Host Search
• B.When adding a user to the Falcon console under the Users application
• C.When performing the sensor installation process
• D.When setting up API keys

Once an exclusion is saved, what can be edited in the future?

• A.Only the options to "Detect/Block" and/or "File Extraction" can be changed
• B.All parts of the exclusion can be changed
• C.The exclusion pattern cannot be changed
• D.Only the selected groups and hosts to which the exclusion is applied can be changed

Where can you modify settings to permit certain traffic during a containment period?

• A.Containment Policy
• B.Prevention Policy
• C.Firewall Settings
• D.Host Settings