CrowdStrike Certified Falcon Administrator - 2024 Version - CCFA-200b Exam Practice Test

A. Add the architect's email address to the manage list for detection and incident emails from the General settings menu

B. Create a custom Fusion SOAR workflow to send an email every time a new detection or incident is created

C. Create a new Falcon user for the architect and assign the Detections and Exceptions Manager role so they are automatically notified for the new detections and incidents

D. Create a new Falcon user for the architect then create and assign a custom Falcon user role so they are automatically notified for the new detections and emails

A. Phase 3

B. Phase 1

C. Phase 2

A. Add sources to the Host Firewall policy

B. Add IPs of update sources to the Containment policy

C. Ensure all internal network IPs are allowed

D. Remove network containment to allow access

A. From Host management, filter for RFM

B. From Host status, filter for RFM

C. From Sensor status, click on the widget RFM

D. From Sensor health, sort using the column heading Sensor status

A. Windows, Linux, and container hosts running the Falcon sensor

B. Windows and Linux hosts running the Falcon sensor

C. Windows and MacOS hosts running the Falcon sensor

D. Windows, Linux, and MacOS hosts running the Falcon sensor

A. Network traffic patterns

B. Current operational status

C. Local performance metrics

D. User login history

A. Script-based execution visibility

B. Additional user mode data visibility

C. Enhanced exploitation visibility

D. Suspicious Scripts and Commands