A security manager wants to ensure that no single administrator can permanently disable detections on a host without a second person's approval. Which of the following approaches best addresses this requirement?

Implement a change-management process that requires a ticket and peer review before the 'Disable detections' action is performed.

Use a prevention policy to block the 'Disable detections' action.

Set a policy that automatically re-enables detections after 24 hours.

Remove the 'Disable detections' permission from all administrator roles.

A Falcon administrator disabled detections on a host for a maintenance window. After the window, the administrator re-enabled detections. However, the security team reports that the host is still not appearing in detection reports. Which of the following is the most likely cause?

The host's prevention policy is blocking all detections.

The sensor has not yet checked in to receive the re-enable configuration.

The re-enable action was not saved because the host was offline.

The host was removed from the console during the maintenance window.

A Falcon administrator is looking for a host in the console to disable detections. The administrator knows the host's IP address but not the exact hostname. How can the administrator locate the host?

Navigate to Detection Monitoring and search by IP address.

Use the Sensor Downloads page to search for the host.

Check the audit log to find the host's IP address.

Use the search bar in Host Management and filter by IP address.

A Falcon administrator disables detections on a host to troubleshoot a performance issue. After the troubleshooting is complete, the administrator forgets to re-enable detections. Several days later, a security analyst notices the host is missing from detection reports. What is the most likely reason for this?

The host's detections are still disabled from the earlier troubleshooting session.

The host was automatically removed from the Falcon console.

The host's prevention policy was changed to a non-reporting mode.

The host's sensor has crashed and is not reporting.

What is the primary purpose of disabling detections for a specific host in CrowdStrike Falcon?

To permanently remove the host from the Falcon console

To temporarily suppress detection alerts for that host while keeping it managed

To uninstall the Falcon sensor from the host

To stop the Falcon sensor from sending telemetry to the cloud

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 3Objective 2

3.2 Disable Detections for a Host CCFA Practice Questions (Page 3)

Part of the Host Management and Setup domain, which makes up ~25% of our current practice bank.

24questions here

5free pages

5concepts

Questions 11–15

11expert · hard
A security manager wants to ensure that no single administrator can permanently disable detections on a host without a second person's approval. Which of the following approaches best addresses this requirement?
Select an answer first
12expert · hard
A Falcon administrator disabled detections on a host for a maintenance window. After the window, the administrator re-enabled detections. However, the security team reports that the host is still not appearing in detection reports. Which of the following is the most likely cause?
Select an answer first
13application · easy
A Falcon administrator is looking for a host in the console to disable detections. The administrator knows the host's IP address but not the exact hostname. How can the administrator locate the host?
Select an answer first
14expert · medium
A Falcon administrator disables detections on a host to troubleshoot a performance issue. After the troubleshooting is complete, the administrator forgets to re-enable detections. Several days later, a security analyst notices the host is missing from detection reports. What is the most likely reason for this?
Select an answer first
15foundation · easy
What is the primary purpose of disabling detections for a specific host in CrowdStrike Falcon?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.