5.5 Configure a Containment Policy for IP Address or Subnet Exclusions That Will Apply to Network Contained Hosts Based on Security Workflow Requirements CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   In the CrowdStrike Falcon console, when you configure a containment policy and want to add a subnet exclusion, which of the following best describes what you are doing?

   • AAdding a hostname (for example, file-server-01) to the exclusion list so that the host with that name is not network-contained.
   • BAdding a single IP address (for example, 192.168.1.10) to the exclusion list so that only that specific host is not network-contained.
   • CAdding a MAC address (for example, 00:1A:2B:3C:4D:5E) to the exclusion list so that the device with that MAC address is not network-contained.
   • DAdding a CIDR block (for example, 192.168.1.0/24) to the exclusion list so that hosts with an IP address in that range are not network-contained when the policy is applied.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does a subnet exclusion affect network containment for a host?

   • AIt allows the contained host to communicate with all IP addresses within that subnet
   • BIt blocks the contained host from communicating with all IP addresses within that subnet
   • CIt has no effect unless the host is also excluded by IP address
   • DIt only allows communication with the first IP address in the subnet
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is designing a containment policy for a critical infrastructure organization. The organization's SCADA system uses a network on the 192.168.100.0/24 range. The security team wants to ensure that contained hosts can still communicate with the SCADA system during an incident. However, the team is concerned that excluding the entire /24 range would allow contained hosts to communicate with other systems on that network that should remain blocked. The team has identified that the SCADA system uses only a few specific IP addresses within the /24 range. What should the architect recommend?

   • AAdd a subnet exclusion for 192.168.100.0/24.
   • BAdd an IP address exclusion for 192.168.100.1.
   • CAdd a subnet exclusion for 192.168.100.0/16.
   • DAdd IP address exclusions for the specific SCADA system IP addresses.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Falcon administrator has configured a containment policy with an IP address exclusion for 10.0.0.5 and a subnet exclusion for 192.168.1.0/24. After the policy is applied, the administrator wants to verify that the exclusions are correctly applied to a contained host. What is the most direct way to verify this in the Falcon console?

   • AVerify the exclusions are applied by checking the host's firewall rules.
   • BCheck the host's network configuration to see if the exclusions are applied.
   • CRun a network scan from the contained host to see if the excluded IPs are reachable.
   • DReview the containment policy's exclusion list in the Falcon console.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of adding an IP address to the exclusion list of a containment policy?

   • ATo prevent the contained host from communicating with that IP address
   • BTo log all traffic between the contained host and that IP address
   • CTo remove the host from containment if it communicates with that IP address
   • DTo allow the contained host to communicate with that IP address
   Reveal Solution Discussion Select an answer first