Important CrowdStrike CCFA-200b Exam Questions

Answer: D

Explanation:

The option that describes what will happen to a host if it is not assigned a Sensor Update policy is that the host will use the Default Sensor Update policy. A Sensor Update policy is a policy that controls how and when the Falcon sensor is updated on a host. You can create and assign custom Sensor Update policies to different hosts or groups in your environment. However, if a host is not assigned to a specific Sensor Update policy, it will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is a ''catch-all'' policy that is enabled by default and has the ''Uninstall and Maintenance Protection'' feature turned on.You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it1.

Answer: C

Explanation:

The option that uses regex to create a detection or take a preventative action is Custom IOA. A Custom IOA (indicator of attack) allows you to define custom rules for detecting or preventing suspicious behavior based on process execution, file write, network connection, or registry events.You can use regex syntax to create a Custom IOA rule that matches the event data that you want to monitor or block1.

Answer: A

Explanation:

On a Windows host, the best command to determine if the sensor is currently running is sc query csagent. This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused.If the service is running, the sensor is also running3.

Answer: A

Explanation:

A workflow condition consists of a parameter, an operator, and a value. A workflow condition is a rule that defines when a workflow should be triggered based on certain criteria or filters. A parameter is a variable or attribute that can be used to filter or match detection events, such as severity, tactic, or host group. An operator is a symbol or word that specifies how to compare or evaluate the parameter and the value, such as equals, contains, or greater than.A value is a constant or expression that provides the expected or desired result for the parameter, such as high, credential dumping, or default group1.

Answer: A

Explanation:

You are usuing RegEx here and need leading '.*' to capture www and then need a '.*' at the end to identify any sites falling under badguydomain.com