CrowdStrike Certified Falcon Administrator - CCFA-200 模擬練習

A. ping falcon.crowdstrike.com

B. This cannot be accomplished with a command

C. sc query csagent

D. netstat -a

A. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running

B. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.

C. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"

D. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"

A. IOA Exclusion

B. Machine Learning Exclusion

C. Sensor Visibility Exclusion

D. IOC Exclusion

A. Real Time Responder - Active Responder

B. Endpoint Manager

C. Prevention Hashes Manager

D. Falcon Administrator

A. The Default Sensor Update should be configured to always automatically upgrade to the latest sensor version

B. The Default Sensor Update policy should align to an organization's overall sensor updating practice while leveraging Auto N-1 and Auto N-2 configurations where possible

C. No configuration is required. Once a Custom Sensor Update policy is created the Default Sensor Update policy is disabled

D. Since the Default Sensor Update policy is pre-configured with recommend settings out of the box, configuration of the Default Sensor Update policy is not required

A. The "Servers" group already has a policy applied to it

B. Host type was not defined correctly within the prevention policy

C. The "Servers" group must be disabled first

D. The new prevention policy should be enabled first

A. Sensor version fixed and Uninstall and maintenance protection turned on

B. Sensor version set to N-2 and Bulk maintenance mode is turned on

C. Sensor version updates off and Uninstall and maintenance protection turned off

D. Sensor version set to N-1 and Bulk maintenance mode is turned on

A. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only

B. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block

C. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead

D. Using IOC management, import the list of hashes and IP addresses and set the action to No Action

A. Individual hosts selected by the administrator

B. Only the groups selected by the administrator

C. Either all hosts or specified groups

D. Only the default host group

A. The exclusion pattern cannot be changed

B. Only the options to "Detect/Block" and/or "File Extraction" can be changed

C. All parts of the exclusion can be changed

D. Only the selected groups and hosts to which the exclusion is applied can be changed

A. Real Time Responder - Script Developer

B. Real Time Responder - Active Responder

C. Real Time Responder - Read Only Analyst

D. Real Time Responder - Administrator

A. Tests the sensor configuration settings before deployment.

B. A mechanism to deploy the oldest supported version of the Falcon Sensor.

C. Used to reset all sensor settings to Default.

D. Acts as a "catch all" policy if no other Sensor Policies are applied.

A. Notifications, alerts, and API's

B. Triggers, actions, and alerts

C. A parameter, an operator, and a value

D. A beginning, a middle, and an end