4.1 Determine the Appropriate Group Assignment for Endpoints and Understand How This Impacts the Application of Policies CCFA Practice Questions (Page 4)

Questions 16–17

1. 16expert · medium

   An administrator is troubleshooting why an endpoint is not receiving the expected prevention policy. The endpoint is in a static group 'Workstations' that has a prevention policy with 'Block' for a specific behavior. The endpoint is also a member of a dynamic group 'Test Machines' that has a prevention policy with 'Detect' for the same behavior. The endpoint is currently receiving 'Detect'. What is the most likely reason?

   • AThe static group 'Workstations' policy is not applied because the endpoint was added to the dynamic group after the static group.
   • BThe dynamic group 'Test Machines' has higher precedence than the static group 'Workstations'.
   • CThe endpoint needs to be removed from the dynamic group for the static group policy to apply.
   • DThe global default policy is overriding the static group policy.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An administrator notices that a group of Linux servers is not receiving the USB device control policy that was configured at the global default level. The servers are in a group called 'Linux Prod' which has a custom prevention policy assigned. What is the most likely reason the USB policy is not applying?

   • AThe Linux servers do not support USB device control policies in Falcon.
   • BThe servers need to be moved to the 'Default Group' for the global USB policy to take effect.
   • CThe global default policy only applies to Windows endpoints.
   • DThe 'Linux Prod' group has a group-level policy that overrides the global default for USB device control, and the group-level policy does not include the USB restriction.
   Reveal Solution Discussion Select an answer first