Free CCFA Crowdstrike CCFA Practice Test Question - Page 6

Question 16 (Topic 1)

What best describes what happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?

Select an option, then click Submit answer.

○ Preventions will be disabled for the host
○ You cannot disable detections for a host
○ The detections for the host are removed from the console immediately and no new detections will display in the console going forward
○ Existing detections for the host remain, but no new detections will display in the console going forward

Reference / correct answer:

The detections for the host are removed from the console immediately and no new detections will display in the console going forward

Most accepted answer: C. The detections for the host are removed from the console immediately and no new detections will display in the console going forward

Community votes: C=4, D=4

Selected Answer: C It's C. Checked in console: "You are about to disable detections for LAB-W10-SOC. By doing so, detections will stop being generated on this host and all existing detections for this host will be hidden from the Falcon Host UI. This data will be restored to the UI if you re-enable detections on this host." upvoted 1 times

Selected Answer: D When you re-enable detections, the data should be restored to the UI. This means once detections are re-enabled, the existing detection data that was hidden (while detections were disabled) will become visible again in the Falcon Host UI. The key takeaway is that while detections are disabled, the data is hidden, but once you re-enable detections, that hidden data is restored to the UI. upvoted 1 times

Selected Answer: C When you select disable detection for a Host in the Host Management section, the shown message is the following: "You are about to disable detections for HOSTNAME. By doing so, detections will stop being generated on this host and all existing detections for this host will be hidden from the Falcon Host UI. This data will be restored to the UI if you re-enable detections on this host. Are you sure you want to disable detections for HOSTNAME?" So yeah, the correct one is C. The detections for the host are removed from the console immediately and no new detections will display in the console going forward upvoted 2 times

Selected Answer: D D. Existing detections for the host remain, but no new detections will display in the console going forward This action does not affect prevention mechanisms; they continue to operate as configured. Disabling detections simply stops new detection alerts from appearing in the console for the specified host. upvoted 1 times

Selected Answer: D ITS D tested on the UI. upvoted 1 times

Question 17 (Topic 1)

On the Host management page which filter could be used to quickly identify all devices categorized as a "Workstation" by the Falcon Platform?

Select an option, then click Submit answer.

○ Status
○ Platform
○ Hostname
○ Type

Question 18 (Topic 1)

What best describes what happens to detections in the console after clicking "Enable Detections" for a host which previously had its detections disabled?

Select an option, then click Submit answer.

○ Enables custom detections for the host
○ New detections will start appearing in the console, and all retroactive stored detections will be restored to the console for that host
○ New detections will start appearing in the console immediately. Previous detections will not be restored to the console for that host
○ Preventions will be enabled for the host

Reference / correct answer:

New detections will start appearing in the console, and all retroactive stored detections will be restored to the console for that host

Most accepted answer: B. New detections will start appearing in the console, and all retroactive stored detections will be restored to the console for that host

Community votes: B=4, C=3

Selected Answer: B Falcon pop up during disablement states that previous detections will come back if host is re-enabled. upvoted 1 times

Selected Answer: C I dont want to see only new detections, but that is my opinion like in other vendor consoles. C should be right, but only in my opinion. upvoted 1 times

Selected Answer: B when you enable detections again, the previously hidden detections will be restored and become visible in the Falcon Host UI. So, the detections are not lost, and the system does indeed restore that data to the UI once you enable detections again for the host. upvoted 3 times

Selected Answer: B Answer is B. When selecting the "enable detections" button in the host management section, the message says: "You are about to enable detections for HOSTNAME. By doing so, detections will resume for this host and will start appearing in the Falcon Host UI. As a reminder, any detections that existed prior to disabling detections will be restored to the UI. Are you sure you want to enable detections for HOSTNAME?" upvoted 3 times

Selected Answer: C C. New detections will start appearing in the console immediately. Previous detections will not be restored to the console for that host This ensures that the host resumes normal detection reporting from the point detections are re-enabled, without retroactively adding past events that occurred during the disabled period. upvoted 1 times

Free CCFA – Crowdstrike CCFA Practice Test Question