2.2 Analyze the Default Policies and Apply the Best Practices to Prepare Workloads for the Falcon Sensor CCFA Practice Questions (Page 3)

Questions 11–14

1. 11foundation · easy

   What is the primary purpose of the default sensor update policy in Falcon?

   • ATo automatically update the sensor to the latest version as soon as it is released
   • BTo ensure all sensors run the same version at all times
   • CTo prevent any sensor updates from being applied without manual approval
   • DTo manage the rollout of sensor updates in a controlled manner to maintain stability
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying Falcon sensors to a large environment with both Windows and Linux servers. The security team wants to ensure that all sensors are running the same version to simplify management. However, they also want to test a new prevention policy on a small subset of Linux servers before rolling it out broadly. What is the most efficient way to achieve both goals?

   • ACreate a single host group for all servers and assign the new prevention policy to it.
   • BUse the 'Sensor Update' policy to set a specific version for all sensors, and create a separate host group for the Linux test servers with the new prevention policy.
   • CCreate a separate host group for all Linux servers and assign the new prevention policy to it.
   • DManually update the sensors on the Linux test servers to the latest version and apply the new policy to all servers.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is deploying Falcon sensors to a mix of Windows and Linux workloads. The security team wants to ensure that all sensors receive the same prevention settings and that any changes are applied consistently. Which default policy should be used to manage these settings centrally?

   • AThe 'Host Isolation' policy, which controls network isolation settings.
   • BThe 'Prevention' policy, which can be assigned to all hosts regardless of OS.
   • CThe 'Sensor Update' policy, which manages the sensor version for all platforms.
   • DThe 'Response' policy, which defines automated response actions.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement accurately describes the purpose of the default Falcon sensor policy that is applied when a sensor is installed?

   • AIt only configures the sensor's network connectivity and does not affect detection or prevention behavior.
   • BIt is a placeholder that has no effect until an administrator manually assigns a custom policy.
   • CIt is applied only to servers and not to workstations.
   • DIt defines the sensor's detection and prevention settings, which are applied immediately upon installation.
   Reveal Solution Discussion Select an answer first