3.2 Disable Detections for a Host CCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has a legacy Windows 7 host that is required for a specific business application. The application frequently triggers false positive detections, overwhelming the security team. The team wants to stop these alerts but still wants to see detections from other hosts. What is the most appropriate action?

   • AUninstall Falcon from the legacy host.
   • BDisable detections for all hosts running Windows 7.
   • CDisable detections for the specific legacy host in Host Management.
   • DCreate a prevention policy that blocks the application from running.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Falcon administrator needs to disable detections for a host that is currently showing as 'Offline' in the console. The administrator is concerned that the action might not work. What is the correct understanding of this situation?

   • AThe action will fail and the administrator must use a different method.
   • BThe action can still be initiated from the console, but it will only take effect when the host comes back online.
   • CThe action will be applied immediately via a direct connection to the host.
   • DThe action cannot be performed on an offline host; the host must be online first.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Falcon administrator is performing a 'Disable detections' action on a host. After confirming the action, the administrator notices that the host still appears to be sending some data to the console. What is the most likely explanation?

   • AThe host is still sending health and status data, but not detection events.
   • BThe host is ignoring the configuration and needs to be rebooted.
   • CThe action failed because the host is not compatible.
   • DThe host is sending detections from before the action was applied.
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A Falcon administrator is asked to disable detections for a host that is running a critical application. The administrator is concerned about the scope of the action. Which of the following statements accurately describes the scope?

   • AThe action affects all hosts in the same host group.
   • BThe action affects all hosts with the same prevention policy.
   • CThe action only affects the selected host, not other hosts in the same group.
   • DThe action affects all hosts in the same organizational unit.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A Falcon administrator needs to disable detections for a specific Linux endpoint that is running a legacy application known to cause false positives. The administrator knows the hostname but is unsure where to find the correct control in the console. Where should the administrator navigate to perform this action?

   • ADetection Monitoring > select the host > 'Mute'
   • BPrevention Policies > select the policy > 'Disable detections'
   • CHost Management > select the host > 'Disable detections'
   • DSensor Downloads > select the host > 'Disable'
   Reveal Solution Discussion Select an answer first