CCFA-200B: CrowdStrike Certified Falcon AdministratorDemo

By CrowdStrike · Question Mode

QuestionQ77

Rules Configuration

Detections associated with a penetration test on a particular server are producing thousands of console entries. Leadership does not need to monitor these detections in Falcon.

What should you do so the team can focus on more relevant detections?

  • A Delete the detections in the console and contain the server undergoing the test
  • B Temporarily disable detections for the server in Host Management and reenable after the test is done
  • C Create a Fusion Workflow to email the SOC team every time the penetration test generates a detection
  • D Permanently disable detections for the server in Host Management
Explanation

Temporarily disabling detections for the specific server prevents authorized penetration-test activity from flooding the Falcon console, while re-enabling detections after testing restores normal monitoring. This avoids both unnecessary alert noise during the test and a persistent detection blind spot afterward.

Community Discussion

No comments yet. Be the first to start the discussion!