CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ57

VerifiedHost Management and Setup

A host has been network contained with Falcon, and you have been asked to update its operating system with zero-day patches. You tried using your patch-update systems for this task, but the jobs fail.

Which configuration steps in the Falcon UI will allow these activities?

Explanation

A Falcon network-contained host can communicate only with CrowdStrike infrastructure and administrator-specified local IP addresses. A containment policy supports IP address or subnet exclusions, so allowlisting the patch-management tools’ specific IP addresses permits patching while the host remains contained.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!