CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ235

VerifiedPolicy Application

After Falcon is successfully installed on a new employee’s laptop, the device is assigned the default prevention policy rather than a custom prevention policy you created. You verify that the Falcon sensor is operating correctly, and confirm that the custom policy is enabled and running successfully on more than 1,000 other Falcon hosts.

What is the most likely cause of this issue?

Explanation

Falcon prevention policies are targeted by assigning host groups to them. A healthy host that is not a member of a host group attached to the custom prevention policy remains subject to the default policy.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!