CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ168

VerifiedPolicy Application

To test a new Falcon sensor version, you created a new sensor update policy and two separate dynamic host groups. One group includes all test Windows servers, and the other includes all Windows servers. The new policy was applied only to the test Windows servers host group.

What is required to safely and successfully test the new sensor update policy on only the test Windows servers?

Explanation

Because the test Windows servers also belong to the all-Windows-servers group, they receive both applicable sensor update policies. The enabled test policy must have higher precedence so its sensor-version setting overrides the broader Windows policy for those test hosts, while the broader policy remains effective for non-test Windows servers.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!