After configuring an IP exclusion in a containment policy, how can an administrator verify that the exclusion is being applied to a contained host?

Reboot the host and check the policy again

Check the host's containment status and test connectivity to the excluded IP

Review the host's detection history

Confirm the host is in the correct host group

A university is configuring a containment policy for its campus network. The university's student information system (SIS) is hosted on a server at 192.168.50.10. The security team wants to ensure that contained hosts can still access the SIS for administrative functions. The team has already added the IP address exclusion for 192.168.50.10 to the containment policy. What should the administrator do next to ensure the exclusion is correctly applied?

Reboot the SIS server to apply the exclusion.

Create a new containment policy for the SIS server.

Add a subnet exclusion for 192.168.50.0/24.

Verify the exclusion is saved and applied to the containment policy.

In the Falcon console, where would an administrator navigate to configure the containment policy that controls IP address and subnet exclusions?

Dashboard > Alerts and Detections

Investigation > Network Containment

Host Setup and Management > Host Groups

Endpoint Security Policies > Containment

A Falcon administrator needs to configure a containment policy for a new host group. The administrator has been asked to add an IP address exclusion for a critical application server at 10.0.0.100. Where in the Falcon console should the administrator navigate to configure this exclusion?

Navigate to the containment policy configuration in the Falcon console.

Navigate to the firewall rules in the Falcon console.

Navigate to the sensor update settings in the Falcon console.

Navigate to the host group settings in the Falcon console.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 5Objective 5

5.5 Configure a Containment Policy for IP Address or Subnet Exclusions That Will Apply to Network Contained Hosts Based on Security Workflow Requirements CCFA Practice Questions (Page 2)

Part of the Policy Application domain, which makes up ~17% of our current practice bank.

14questions here

3free pages

6concepts

Questions 6–10

6foundation · easy
After configuring an IP exclusion in a containment policy, how can an administrator verify that the exclusion is being applied to a contained host?
Select an answer first
7application · medium
A university is configuring a containment policy for its campus network. The university's student information system (SIS) is hosted on a server at 192.168.50.10. The security team wants to ensure that contained hosts can still access the SIS for administrative functions. The team has already added the IP address exclusion for 192.168.50.10 to the containment policy. What should the administrator do next to ensure the exclusion is correctly applied?
Select an answer first
8foundation · easy
In the Falcon console, where would an administrator navigate to configure the containment policy that controls IP address and subnet exclusions?
Select an answer first
9foundation · easy
An organization's security workflow requires that contained hosts maintain access to the patch management server on the 172.16.5.0/24 network. What is the most appropriate exclusion to configure?
Select an answer first
10application · medium
A Falcon administrator needs to configure a containment policy for a new host group. The administrator has been asked to add an IP address exclusion for a critical application server at 10.0.0.100. Where in the Falcon console should the administrator navigate to configure this exclusion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

5.5 Configure a Containment Policy for IP Address or Subnet Exclusions That Will Apply to Network Contained Hosts Based on Security Workflow Requirements CCFA Practice Questions (Page 2)

Questions 6–10

After configuring an IP exclusion in a containment policy, how can an administrator verify that the exclusion is being applied to a contained host?

In the Falcon console, where would an administrator navigate to configure the containment policy that controls IP address and subnet exclusions?

An organization's security workflow requires that contained hosts maintain access to the patch management server on the 172.16.5.0/24 network. What is the most appropriate exclusion to configure?

A Falcon administrator needs to configure a containment policy for a new host group. The administrator has been asked to add an IP address exclusion for a critical application server at 10.0.0.100. Where in the Falcon console should the administrator navigate to configure this exclusion?

Keep studying — Policy Application