3.2 Disable Detections for a Host CCFA Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   After re-enabling detections for a host in Falcon, what is the expected outcome?

   • AThe host will resume generating detection alerts for new malicious activity
   • BThe host will be moved to a different sensor group
   • CAll previously suppressed detections will be automatically re-created
   • DThe sensor will need to be re-registered with the Falcon cloud
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A Falcon administrator is evaluating the operational impact of disabling detections on a host. The administrator is concerned about the host's compliance posture. Which of the following is the most accurate statement regarding compliance?

   • ADisabling detections automatically triggers a compliance violation.
   • BDisabling detections may cause the host to fail compliance checks that require continuous monitoring.
   • CDisabling detections has no impact on compliance because prevention is still active.
   • DDisabling detections is required for compliance with data privacy regulations.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   After selecting a host and choosing to disable detections, what does Falcon require before the action is applied?

   • AAn approval from another administrator
   • BA confirmation dialog to confirm the action
   • CA reboot of the host
   • DA valid reason code from a predefined list
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which operational consideration is most important when deciding to disable detections for a host?

   • AThe geographic location of the host
   • BThe host's operating system version
   • CThe duration of the disablement and the reason for it
   • DThe number of other hosts in the same group
   Reveal Solution Discussion Select an answer first