Question 1

Which of the following would give you information about inactive sensors within the Falcon console?

Options :

A : Sensor Update Policies

B : Sensor Downloads

C : Sensor Coverage Lookup

D : Sensor Health

Answer: D

Question 2

What are custom alerts based on?

Options :

A : Custom workflows

B : Custom event based triggers

C : Predefined alert templates

D : User defined Splunk queries

Answer: B

Question 3

You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

Options :

A : Prevention Policy Audit Trail

B : Prevention Policy Debug

C : Prevention Hashes Ignored

D : Machine-Learning Prevention Monitoring

Answer: A

Question 4

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?

Options :

A : Proxy information

B : NMAP scanning

C : TCP inspection

D : Deep packet inspection

Answer: D

Question 5

On the Host management page which filter could be used to quickly identify all devices categorized as a "Workstation" by the Falcon Platform?

Options :

A : Hostname

B : Status

C : Type

D : Platform

Answer: C