Question 1

When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

Options :

A : Custom IOA Rule Groups

B : Custom IOC Groups

C : Enterprise Groups

D : Operating System Groups

Answer: D

Question 2

The Falcon Administrator has created a new prevention policy to apply to the "Servers" group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?

Options :

A :

The new prevention policy should be enabled first

B :

Host type was not defined correctly within the prevention policy

C :

The "Servers" group already has a policy applied to it

D :

The "Servers" group must be disabled first

Answer: C

Question 3

An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

Options :

A : File exclusions are not aligned to groups or hosts

B : There is a limit of three groups of hosts applied to any exclusion

C : There is no limit and exclusions can be applied to any or all groups

D : Each exclusion can be aligned to only one group of hosts

Answer: B

Question 4

Which of the following is TRUE regarding disabling detections for a host?

Options :

A :

After disabling detections, the data for all existing detections prior to disabling detections is removed from the Event Search

B :

After disabling detections, the host will operate in Reduced Functionality Mode (RFM) until detections are enabled

C :

The DetectionSummaryEvent continues being sent to the Streaming API for that host

D :

The detections for that host are removed from the console immediately. No new detections will display in the console going forward unless detections are enabled

Answer: D

Question 5

How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

Options :

A : By ensuring each user has set the 'pop-ups allowed' in their User Profile configuration page

B : By enabling 'Upload quarantined files' in the General Settings configuration page

C : By turning on the 'Notify End Users' setting at the top of the Prevention policy details configuration page

D : By selecting 'Enable pop-up messages' from the User configuration page

Answer: C