On which page of the Falcon console can one locate the Customer ID (CID)?
AAPI Clients and Keys
BSensor Dashboard
CHosts Management
DSensor Downloads
If you are not able to update your Falcon sensors on a regular basis, what is the maximum recommended aging period before updating your sensors?
A7 days
B60 days
C90 days
DThere is no maximum aging period
What best describes what happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?
APreventions will be disabled for the host
BYou cannot disable detections for a host
CThe detections for the host are removed from the console immediately and no new detections will display in the console going forward
DExisting detections for the host remain, but no new detections will display in the console going forward
When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?
AThe sensor would provide minimal protection
BThe sensor provides no protection, and only collects Sensor Heart Beat events
CThe sensor would function as normal
DThe sensor would provide protection as normal, without event telemetry
What internet domain needs to be added to any required allowlists to allow sensors to communicate with the CrowdStrike Cloud?
Afalconcloud.net
Bcloudprotect-cs.net
Ccloudsink.net
Dcsfalcon.net
Why would you use the Prevention Policy Debug Report?
ATo confirm that prevention policy precedence was applied to hosts
BTo confirm the number of detections on a host
CTo confirm that prevention policy settings were applied to a host
DTo confirm the number of host groups to which a policy was applied
The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?
AProxy information
BDeep packet inspection
CNMAP scanning
DTCP inspection
After Network Containing a host, your Incident Response team states they are unable to remotely connect to the host. Which of the following would need to be configured to allow remote connections from specified IP's?
AResponse Policy
BIP Allowlist Management
CMaintenance Token
DContainment Policy
Assume the Falcon Sensor was installed on a Virtual Machine template using the installation parameter NO_START=1. Afterward, the Virtual Machine template is rebooted. What is the effect on the Falcon Sensor after reboot?
AThe Falcon Sensor would start, but only send a heartbeat to the Falcon console
BThe Falcon Sensor would not automatically start on reboot. It would have to be manually started
CThe Falcon Sensor would disable BIOS checks at startup
DThe Falcon Sensor would start at reboot and generate an Agent ID
The Remote Access Graph in Visibility Reports displays:
Aa bar chart where a bar represents a daily count of remote connections
Ba geographical chart showing the geo-location of remote IP address
Ca graph showing connections between hosts and users
Da pie chart showing a count per remote logon type
Which of the following policies allowlist network traffic even while a host is Network Contained?
AFirewall Policy
BIP Allowlist Policy
CResponse Policy
DContainment Policy
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
A75 Days
B45 Days
C60 Days
D90 Days
What three things does a workflow condition consist of?
ANotifications, alerts, and API's
BTriggers, actions, and alerts
CA parameter, an operator, and a value
DA beginning, a middle, and an end
When editing an existing IOA exclusion, what can NOT be edited?
AThe exclusion name
BAll parts of the exclusion can be changed
CThe IOA name
DThe hosts groups
When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?
A.*.baddomain.xyz|baddomain.xyz
Bbaddomain.xyz|baddomain.xyz
C.baddomain.xyz|baddomain.xyz.
DCustom IOA rules cannot be created for domains
Which of the following tools developed by CrowdStrike is intended to help with removal of the CrowdStrike Windows Falcon Sensor?
ACSUninstallTool.exe
BUninstallTool.exe
CCrowdStrikeRemovalTool.exe
DFalconUninstall.exe
How many days will an inactive host remain visible within the Host Management or Trash pages?
A90 days
B120 days
C15 days
D45 days
Which of the following steps are required to delete a sensor update policy?
ARemove the policy from all assigned host groups, disable the policy, then click Delete from the policy's settings
BFrom the policy's settings, disable all toggles first, then click Delete
CRemove the policy from all assigned host groups, then click Delete from the policy's settings
DFrom the policy's settings, disable the policy, then click Delete
What best describes the relationship between Sensor Update policies and Operating Systems?
ASensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems
BA Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
CWindows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions
DWindows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies
Which option best describes the general process for a manual installation of the Falcon Sensor on MacOS?
AGrant the Falcon package Full Disk Access, install the Falcon package, load the Falcon Sensor with the command 'falconctl stats'
BInstall the Falcon package passing it the installation token in the command line
CInstall the Falcon package, use falconctl to license the sensor, approve the system extension, grant the sensor Full Disk Access
DGrant the Falcon package Full Disk Access, install the Falcon package, use falconctl to license the sensor
Which user role will NOT enable the user to connect to a host using Real Time Response?
AReal Time Response -Administrator
BReal Time Response - Active Responder
CReal Time Response - Read-Only Analyst
DFalcon Administrator
What is the earliest version of Windows Server that a Sensor is compatible with?
AServer 2012
BServer 2003
CServer 2008 R2 SP1
DServer 2008
Your development team is working on a new enterprise application, but Falcon starts creating alerts during testing. The alert points to, "C:\Users\Bob\DevCode\felix.dll". In the detection, you see that it's triggering only on a specific Falcon IOA. What would be the best course of action for this situation?
ACreate a sensor visibility exclusion for "C:\Users\Bob\DevCode\felix.dll"
BCreate an IOA exclusion for "C:\Users\Bob\DevCode\felix.dll"
CCreate a Custom IOC and set it to "Allow" for "C:\Users\Bob\DevCode\felix.dll"
DManually turn off the built-in IOA through prevention policies
Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?
AReduce Functionality Audit Report
BInactive Sensor Report
CSensor Health Report
DSensor Coverage Lookup
What will happen to a host that is not part of any group which has a prevention policy assigned to it?
AThe host will apply the default prevention policy
BThe host will apply a sensor-based policy to prevent a majority of known threats
CThe host will send a notification to the Falcon Administrator to assign a prevention policy