4.2 Apply Best Practices When Managing Host Groups CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to audit host group membership and policy assignments regularly?

   • ATo automatically update the host group hierarchy
   • BTo maintain compliance and operational integrity
   • CTo increase the speed of the Falcon sensor
   • DTo reduce the number of host groups
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   An administrator is cleaning up host groups and finds a group 'Temp-Web' that was created for a temporary project. The project is over, and the group is no longer needed. However, the administrator is unsure if any policies or reports reference this group. What is the best practice before deleting the group?

   • ARename the group to 'Old - Temp-Web' and leave it as is.
   • BConvert the group to a dynamic group with a rule that matches no hosts.
   • CDelete the group immediately to clean up the console.
   • DArchive the group first, then check for references before deleting.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a recommended best practice when a host group is no longer needed but you want to preserve its historical policy assignments?

   • ARename the host group to 'Inactive'
   • BDelete the host group immediately
   • CRemove all hosts from the group and leave it empty
   • DArchive the host group instead of deleting it
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is required to maintain an audit trail of all changes to host groups, including who made the change and when. Which Falcon feature should the administrator enable or use to meet this requirement?

   • AEnable 'Audit Logging' in the Falcon console and review the audit logs for host group changes.
   • BEnable the 'Host Group Change Log' in the Falcon console settings.
   • CAssign a dedicated auditor role to all administrators to track their changes.
   • DUse the Falcon API to periodically export host group configurations and compare them manually.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Falcon administrator is designing a host group hierarchy for a company with multiple business units. Each business unit has its own security team that manages its own host groups. The administrator wants to ensure that each business unit can manage its own groups but cannot modify groups belonging to other business units. What is the best way to achieve this?

   • ACreate a flat structure with groups named by business unit and assign the 'Falcon Administrator' role to all security teams.
   • BCreate a single top-level group for all business units and use policy overrides to differentiate.
   • CCreate a hierarchy by environment first (Dev, Prod) and then by business unit, and assign permissions accordingly.
   • DCreate a top-level group for each business unit and assign the 'Manage Host Groups' permission to each business unit's security team on their respective group.
   Reveal Solution Discussion Select an answer first