4.1 Determine the Appropriate Group Assignment for Endpoints and Understand How This Impacts the Application of Policies CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses hostname-based dynamic groups to assign policies. They have a rule that matches hostnames starting with 'DB-' for database servers and another rule for 'WEB-' for web servers. A new server is provisioned with hostname 'DB-WEB-01'. Which group will this server be assigned to?

   • AThe 'DB-' group, because the rule is evaluated first and the hostname matches it.
   • BThe 'Default Group', because the hostname matches multiple rules and causes a conflict.
   • CThe 'WEB-' group, because the hostname contains 'WEB'.
   • DBoth groups, because the hostname matches both rules.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   An administrator is reviewing policy application for an endpoint that is in a static group 'Finance' and a dynamic group 'High Risk'. The 'Finance' group has a prevention policy that blocks 'Powershell.exe' from running. The 'High Risk' group has a prevention policy that allows 'Powershell.exe'. The endpoint is currently allowing 'Powershell.exe'. What is the most likely explanation?

   • AThe dynamic group 'High Risk' has higher precedence than the static group 'Finance', so its policy is applied.
   • BThe global default policy allows 'Powershell.exe' and overrides both group policies.
   • CThe static group 'Finance' policy is not applied because the endpoint was added to the dynamic group after the static group.
   • DThe endpoint is not actually a member of the 'Finance' group.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An endpoint is moved from a group with a custom firewall policy to a group that has no firewall policy assigned. What is the expected firewall behavior for that endpoint?

   • AThe firewall is disabled because no group policy is assigned.
   • BThe endpoint uses the last policy that was active before the move.
   • CThe endpoint falls back to the global firewall policy.
   • DThe previous group's firewall policy continues to apply.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has a dynamic group that includes all endpoints with the tag 'Production'. They want to exclude a specific endpoint from this group because it is being decommissioned but still needs Falcon protection. What is the most effective way to exclude this endpoint from the dynamic group?

   • ARemove the 'Production' tag from the endpoint.
   • BCreate a new dynamic group rule that excludes the endpoint's hostname.
   • CChange the dynamic group rule to use hostname instead of tags.
   • DManually move the endpoint to a different static group.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator needs to temporarily apply a more aggressive prevention policy to a single endpoint for a penetration test. The endpoint is currently in a dynamic group that matches all servers in the 'DMZ' subnet. What is the most efficient way to apply the temporary policy without affecting other DMZ servers?

   • AMove the endpoint to the 'Default Group' and apply the aggressive policy as the global default.
   • BApply the aggressive policy directly to the endpoint in the Falcon console.
   • CCreate a new static group, add the endpoint to it, assign the aggressive policy to that static group, and remove the endpoint from the dynamic group.
   • DTemporarily change the dynamic group's policy to the aggressive one and revert after the test.
   Reveal Solution Discussion Select an answer first