4.1 Determine the Appropriate Group Assignment for Endpoints and Understand How This Impacts the Application of Policies CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An administrator wants to create a group that includes all Linux endpoints in a specific subnet. Which combination of endpoint attributes can be used to define this dynamic group?

   • ASensor version and memory size
   • BHostname and last seen time
   • COperating system and IP address
   • DMAC address and disk usage
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An endpoint is currently in a group with a prevention policy that has 'Notify' as the action for a specific detection. The administrator moves the endpoint to a group with a prevention policy that has 'Block' for the same detection. What will happen to the endpoint's behavior for this detection after the move?

   • AThe endpoint will now block the detection, as the new group's policy applies immediately.
   • BThe endpoint will block and notify, because both policies are merged.
   • CThe endpoint will continue to notify, because the previous group's policy remains cached.
   • DThe endpoint will not take any action until the policy is manually refreshed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a dynamic group that matches all endpoints with the tag 'Production'. They want to create a subgroup of 'Production' endpoints that also have the tag 'Database' and apply a stricter policy to them. What is the best way to achieve this?

   • AModify the existing 'Production' dynamic group to also require the 'Database' tag.
   • BCreate a static group and manually add endpoints that have both tags.
   • CCreate a new dynamic group with a rule that matches both tags 'Production' and 'Database'.
   • DUse a dynamic group based on hostname prefix 'DB-' and assume all database servers have that prefix.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A Falcon administrator has a global policy setting that blocks all USB devices. A specific group has a policy that allows USB devices for a particular department. What is the effective behavior for endpoints in that group?

   • AThe global setting overrides the group policy, so USB devices remain blocked.
   • BThe policies merge, and USB devices are allowed only if both settings agree.
   • CThe group-level policy overrides the global setting, so USB devices are allowed for those endpoints.
   • DThe endpoint inherits the global setting until the group policy is explicitly enabled.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon administrator moves a Windows endpoint from the 'Marketing' group to the 'Finance' group. The 'Marketing' group has a prevention policy that blocks PowerShell script execution, while the 'Finance' group's prevention policy allows it. After the move, what is the expected enforcement behavior on the endpoint?

   • AThe endpoint will immediately begin allowing PowerShell script execution because the 'Finance' group policy now applies.
   • BThe endpoint will block PowerShell because the more restrictive of the two group policies always applies.
   • CThe endpoint will require a reboot for the new policy to take effect.
   • DThe endpoint will continue blocking PowerShell until the next scheduled policy update.
   Reveal Solution Discussion Select an answer first