Question 1

An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

Options :

A : File exclusions are not aligned to groups or hosts

B : There is a limit of three groups of hosts applied to any exclusion

C : There is no limit and exclusions can be applied to any or all groups

D : Each exclusion can be aligned to only one group of hosts

Answer: B

Question 2

What best describes the relationship between Sensor Update policies and Operating Systems?

Options :

A :

A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)

B :

Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions

C :

Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems

D :

Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies

Answer: A

Question 3

Which Real-Time response (RTR) role is automatically assigned to the falcon administrator ?

Options :

A :

No RTR roles are automatically assigned to the Falcon administrator

B : Administrator

C : Read only analyst

D : Active Responder

Answer: A

Question 4

You have a Windows host on your network in

Reduced functionality mode (RFM). While the

system is in RFM, which of the following is TRUE?

Options :

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventions

will not be triggered

Answer: D

Question 5

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

Options :

A : Configure a Real Time Response policy allowlist with the specific IP addresses

B : Configure a Containment Policy with the specific IP addresses

C : Configure a Containment Policy with the entire internal IP CIDR block

D : Configure the Host firewall to allowlist the specific IP addresses

Answer: D