CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ77

VerifiedRules Configuration

Detections associated with a penetration test on a particular server are producing thousands of console entries. Leadership does not need to monitor these detections in Falcon.

What should you do so the team can focus on more relevant detections?

Explanation

Temporarily disabling detections for the specific server prevents authorized penetration-test activity from flooding the Falcon console, while re-enabling detections after testing restores normal monitoring. This avoids both unnecessary alert noise during the test and a persistent detection blind spot afterward.

Community Discussion

No comments yet. Be the first to start the discussion!