CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ173

VerifiedPolicy Application

During a simulated training exercise with the security team, an analyst used Falcon to network-contain a host. It was later found that containing this particular host disrupted key business processes and caused lost revenue.

As the Falcon Administrator, what can be done to prevent this disruption in the future?

Explanation

Falcon network containment permits a contained host to communicate with CrowdStrike cloud infrastructure and with local IP addresses specified by the administrator. Allowlisting the IP addresses used by the essential business processes in the containment policy preserves those required communications while the host remains contained.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!