3.3 Explain the Effect of Disabling Detections on a Host CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An administrator disables detections on a host. Which statement correctly describes the scope of this action?

   • AIt stops the Falcon sensor from collecting any telemetry from the host.
   • BIt prevents the host from being able to receive policy updates from the Falcon console.
   • CIt suppresses detection-related alerts and visibility for that host while leaving other sensor functions active.
   • DIt permanently removes the host from the Falcon console and requires reinstallation of the sensor.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security analyst wants to reduce alert noise from a specific host without stopping the sensor or losing telemetry. What should the analyst do?

   • ARemove the host from the Falcon console.
   • BUninstall the Falcon sensor from the host.
   • CChange the host's prevention policy to block all activity.
   • DDisable detections on that host.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the effect of disabling detections on a host's prevention capabilities?

   • APrevention is unaffected, but the host stops sending telemetry.
   • BPrevention continues to work, but the host will not generate detection alerts.
   • CPrevention is reduced to only blocking known malware.
   • DPrevention is completely disabled on the host.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After re-enabling detections on a host, what should an administrator consider?

   • AThe host will lose all prevention settings.
   • BThe host will immediately resume sending detection alerts for new activity.
   • CThe host will need to be rebooted for the change to take effect.
   • DThe host will be removed from the Falcon console and need to be re-enrolled.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is working on a host that is experiencing false positives from a specific application. They want to reduce the noise without losing visibility into other threats. What should they do?

   • AUninstall the Falcon sensor
   • BCreate a detection exclusion for the specific application
   • CDisable detections on the host
   • DSet the prevention policy to 'Monitor' mode
   Reveal Solution Discussion Select an answer first