CCFA-200 試験問題を無料オンラインアクセス

What are custom alerts based on?

• A.User defined Splunk queries
• B.Predefined alert templates
• C.Custom event based triggers
• D.Custom workflows

With Custom Alerts, it is possible to __________.

• A.be alerted to activity in real-time
• B.receive an alert in an email
• C.configure prevention actions for alerting
• D.schedule the alert to run at any interval

What should be disabled on firewalls so that the sensor's man-in-the-middle attack protection works properly?

• A.Deep packet inspection
• B.Windows Proxy
• C.Linux Sub-System
• D.PowerShell

You want to create a detection-only policy. How do you set this up in your policy's settings?

• A.Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.
• B.Select the "Detect-Only" template. Disable hash blocking and exclusions.
• C.You can't create a policy that detects but does not prevent. Use Custom IOA rules to detect.
• D.Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.

What is the purpose of the Default Sensor Policy?

• A.Used to reset all sensor settings to Default.
• B.A mechanism to deploy the oldest supported version of the Falcon Sensor.
• C.Acts as a "catch all" policy if no other Sensor Policies are applied.
• D.Tests the sensor configuration settings before deployment.