CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ27

VerifiedPolicy Application

Your organization has a group of servers that must not be accessed remotely, including through Real Time Response (RTR). These servers are already in their own Falcon host group. What should you do next to disable RTR only for these hosts?

Explanation

Falcon Response Policies apply response capabilities to assigned host groups. Creating a dedicated policy with Real Time Response turned off and assigning it to the existing host group prevents RTR access for that group without changing the RTR setting for other hosts that use the default policy.

Community Discussion

No comments yet. Be the first to start the discussion!