5.1 Determine the Appropriate Prevention Policy Settings for Endpoints and Explain How This Impacts Security Posture CCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   A retail company has a mix of Windows and macOS endpoints. They want to ensure that Falcon sensors cannot be uninstalled or tampered with by users. Which prevention policy setting should they enable?

   • ACredential Theft Protection
   • BUSB Device Control
   • CSensor Tamper Protection
   • DData Exfiltration Prevention
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An administrator enables the 'Unknown Executable Prevention' setting with the action 'Block' in a prevention policy. How does this setting affect the security posture of the endpoints assigned to that policy?

   • AIt weakens security posture by allowing all unknown executables to run without any analysis, increasing the risk of malware infection.
   • BIt has no impact on security posture because the setting only affects files that are already known to be malicious.
   • CIt reduces the attack surface by preventing all unknown executables from running, but may increase operational overhead due to false positives.
   • DIt improves security by allowing all unknown executables to run while the cloud analyzes them, ensuring no legitimate software is blocked.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company is rolling out Falcon to 500 Windows endpoints. The security team wants to minimize disruption to production systems while still blocking known malware. They plan to start with a policy that logs suspicious activity but does not block it, then gradually tighten settings. Which prevention policy setting should they configure first?

   • ADisable all prevention settings
   • BSet all prevention settings to 'Detect' mode
   • CEnable all prevention settings in 'Block' mode
   • DCreate a custom policy with a mix of 'Block' and 'Detect' modes based on server roles
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the CrowdStrike Falcon console, which prevention policy setting is used to control whether a suspicious executable is allowed to run while the cloud analyzes it for malicious behavior?

   • ASensor Anti-Malware
   • BUnknown Executable Prevention
   • CCloud Anti-Malware
   • DQuarantine
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which prevention policy setting in the Falcon console is specifically designed to block the execution of scripts that attempt to run from a file system location commonly used by attackers?

   • AScript-based Execution Prevention
   • BFile System Protection
   • CExploit Mitigation
   • DScript-based Execution Control
   Reveal Solution Discussion Select an answer first