Free CrowdStrike CCFA-200b Exam Dumps Questions & Answers

What is the primary purpose of custom IOA rules?

• A.  Configure network settings
• B.  Manage system updates
• C.  Block known malware
• D.  Identify malicious behavior

Your development team is working on a new enterprise application, but Falcon starts creating alerts during testing. The alert points to "C:\Users\Bob\DevCode\felix.dll". In the detection, you see that it is triggering only on a specific Falcon IOA. What would be the best course of action for this situation?

• A.  Create an IOA exclusion for "C:\Users\Bob\DevCode\felix.dll"
• B.  Create a Custom IOC and set it to "Allow" for "C:\Users\Bob\DevCode\felix.dll"
• C.  Manually turn off the built-in IOA through prevention policies
• D.  Create a sensor visibility exclusion for "C:\Users\Bob\DevCode\felix.dll"

What are the two automated triggers that cause a Fusion SOAR workflow to run?

• A.  Condition and action triggers
• B.  Event and action triggers
• C.  Incident and detections triggers
• D.  Event and scheduled triggers

In order to receive the most stable sensor updates, what level of automatic sensor updates should be applied to a host?

• A.  Pinned sensor version
• B.  Auto-Latest
• C.  Auto-N-2
• D.  Auto-N-1

Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect should be notified about any incidents with a CrowdScore of 1.0 or higher. What can the Falcon Administrator do to ensure the architect is properly alerted?

• A.  Add the architect's email address to the manage list for detection and incident emails from the General settings menu
• B.  Create a new Falcon user for the architect then create and assign a custom Falcon user role so they are automatically notified for the new detections and emails
• C.  Create a new Falcon user for the architect and assign the Detections and Exceptions Manager role so they are automatically notified for the new detections and incidents
• D.  Create a custom Fusion SOAR workflow to send an email every time a new detection or incident is created