4.1 Determine the Appropriate Group Assignment for Endpoints and Understand How This Impacts the Application of Policies CCFA Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A company has a global default that blocks all USB devices. A group 'Developers' has a prevention policy that allows USB devices. An endpoint in the 'Developers' group is also a member of a dynamic group 'Contractors' that has a prevention policy that blocks USB devices. What will be the USB policy on this endpoint?

   • AAllow, because the global default is overridden by the 'Developers' group policy.
   • BBlock, because the 'Contractors' dynamic group takes precedence over the 'Developers' static group.
   • CBlock, because the global default always applies unless overridden by a single group.
   • DAllow, because the 'Developers' static group takes precedence over the 'Contractors' dynamic group.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has a global default response policy that sets 'Quarantine' as the action for malware detection. A group called 'Servers' has a response policy that sets 'Delete' for malware. A server in the 'Servers' group is also a member of a dynamic group called 'High Value Assets' which has a response policy that sets 'Quarantine'. What action will be taken when malware is detected on this server?

   • AQuarantine, because the global default always applies unless a group explicitly overrides it, and 'Quarantine' is the global default.
   • BQuarantine, because the 'High Value Assets' dynamic group policy takes precedence over the static 'Servers' group policy.
   • CDelete, because the server is a member of the 'Servers' group and that policy is more specific to the server's role.
   • DDelete, because the 'Servers' group is a static group and static groups always take precedence.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A Falcon administrator needs to automatically assign newly deployed Windows servers to a group that applies a specific sensor update policy. Which endpoint attribute can be used as the basis for this dynamic group assignment?

   • AInstalled application version
   • BHostname
   • CNetwork throughput
   • DLast login timestamp
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has a global default sensor update policy that schedules updates at 2:00 AM. A group called 'Night Shift' has a sensor update policy scheduled at 11:00 PM. An endpoint in the 'Night Shift' group is moved to a group with no sensor update policy assigned. What update schedule will the endpoint now follow?

   • AThe 11:00 PM schedule, because the endpoint was previously in the 'Night Shift' group.
   • BNo updates will occur because the new group has no sensor update policy.
   • CThe endpoint will update immediately upon the move to the new group.
   • DThe global default of 2:00 AM, because the new group has no sensor update policy and the endpoint falls back to the global default.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An administrator moves an endpoint from Group A to Group B. Group A has a prevention policy that blocks a specific executable, while Group B's prevention policy allows it. What is the immediate effect on the endpoint?

   • AThe endpoint follows both policies, and the most restrictive setting is enforced.
   • BThe endpoint continues to follow Group A's policy until the sensor is restarted.
   • CThe endpoint now follows Group B's policy, so the executable is allowed.
   • DThe endpoint is temporarily unmanaged until the administrator confirms the move.
   Reveal Solution Discussion Select an answer first