6.2 Interpret Business Requirements in Order to Allow Trusted Activity, Resolve False Positives and Fix Performance Issues CCFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A logistics company reports that Falcon is causing noticeable latency on servers running a custom inventory management system. The system frequently opens and closes many short-lived network connections to a central database. The security team has confirmed this is normal behavior for the application. The administrator needs to reduce the performance impact while still detecting unusual network activity from other processes. What should the administrator do?

   • ACreate a rule that excludes the inventory system's process from network connection monitoring.
   • BDisable the network connection monitoring rule for all servers.
   • CMove the inventory system to a virtual machine with more CPU resources.
   • DIncrease the sensor's logging verbosity to capture more details about the connections.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard · select all that apply

   A large organization is experiencing performance issues on endpoints running a legacy enterprise resource planning (ERP) application. The application performs frequent, legitimate registry reads and writes to a specific set of registry keys. Falcon is causing noticeable CPU overhead on these endpoints. The security team wants to reduce the performance impact without weakening detection for other registry activity. Which two actions should the administrator take? (Select all that apply.)

   • AIncrease the sensor's cache size to improve performance.
   • BMove the ERP application to a different server with more CPU resources.
   • CCreate an exclusion for the ERP application's process.
   • DCreate an exclusion for the specific registry keys that the ERP application accesses.
   • EDisable the registry monitoring rule on the affected endpoints.
   Check answers Discussion Select an answer first
4. 8foundation · easy

   A Falcon rule is causing latency on endpoints because it performs deep inspection on every file operation. Which configuration change is most likely to reduce latency while keeping the rule effective?

   • ARemove the rule from the policy
   • BExpand the rule to monitor all file types
   • CNarrow the rule's scope to only monitor specific file extensions
   • DIncrease the rule's frequency to check files more often
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A hospital's IT team reports that Falcon is alerting on a custom electronic medical records (EMR) application. The application routinely opens a network socket to a local database server and writes temporary files to a shared directory. These actions are required for the application to function. The security team confirms the behavior is benign and wants to stop the alerts without weakening detection for other processes. What should the administrator do?

   • AAdd the EMR application's executable hash to the global exclusion list.
   • BCreate a rule that excludes the EMR application's file path and network destination from detection.
   • CDisable the detection rule that is generating the alerts for the EMR application.
   • DIncrease the alert threshold for the specific detection rule to reduce noise.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A server is experiencing high CPU usage due to Falcon's scanning of a large directory that changes frequently. Which rule configuration change is most likely to reduce the performance impact?

   • ADisable the sensor's real-time protection
   • BIncrease the number of detection rules for the directory
   • CAdd the directory to an exclusion list to reduce scanning overhead
   • DSet the sensor to 'Aggressive' scanning mode
   Reveal Solution Discussion Select an answer first