3.3 Explain the Effect of Disabling Detections on a Host CCFA Practice Questions (Page 3)

Questions 11–12

1. 11application · medium

   An administrator disabled detections on a host to reduce noise during a migration. After the migration, they re-enable detections. What should they expect?

   • ADetection events that occurred while detections were disabled will not appear retroactively
   • BThe host will need to be rebooted for detections to take effect
   • CThe host will be automatically added to a new prevention policy
   • DAll detection events that occurred during the disabled period will appear in the console
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is planning to disable detections on a host for a scheduled maintenance. They are concerned about the impact on their incident response capabilities. What is the best way to mitigate the risk?

   • ADisable detections only for the duration of the maintenance and re-enable immediately after
   • BDisable detections and also disable prevention to reduce resource usage
   • CDisable detections and rely on prevention to block all threats
   • DDisable detections and uninstall the sensor to avoid any interference
   Reveal Solution Discussion Select an answer first