CrowdStrike CCFA-200 Quiz 1 Topic 13 Questions 1-5

Question: 1

Under the "Next-Gen Antivirus: Cloud Machine Learning" setting there are two categories, one of them is "Cloud Anti-Malware" and the other is:

AAdware & PUP

BAdvanced Machine Learning

CSensor Anti-Malware

DExecution Blocking

Show Answer

Question: 2

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

AClone the workflow and replace the existing email with your CISO's email

BAdd a sequential action to send a custom email to your CISO

CAdd a parallel action to send a custom email to your CISO

DAdd the CISO's email to the existing action

Show Answer

Question: 3

How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

AUnder Dashboards and reports, choose the Sensor Report. Set the 'Last Seen' dropdown to 30 days and reference the Inactive Sensors widget

BUnder Host setup and management, choose the Host Management page. Set the group filter to 'Inactive Sensors'

CUnder Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days

DUnder Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

Show Answer

Question: 4

Custom IOA rules are defined using which syntax?

AGlob

BPowerShell

CYara

DRegex

Show Answer

Question: 5

When would the No Action option be assigned to a hash in IOC Management?

AWhen you want to save the indicator for later action, but do not want to block or allow it at this time

BAdd the indicator to your allowlist and do not detect it

CThere is no such option as No Action available in the Falcon console

DAdd the indicator to your blocklist and show it as a detection

Show Answer

CrowdStrike CCFA-200 Quiz:1 Topic:13 Questions:1-5