A business unit reports that a critical application is being blocked by a Falcon prevention policy. The business requirement is to keep the application functional while maintaining security visibility. Which rule configuration action best aligns with this requirement?

Disable the prevention policy entirely for that business unit

Create an exclusion for the application's file path and allow the behavior with monitoring

Ignore the report and keep the current configuration unchanged

Increase the prevention level to block all similar applications

A company uses a custom script that performs administrative tasks. Falcon currently blocks the script, and the business wants to allow it without losing the ability to detect other threats. Which rule configuration best achieves this?

Create an exclusion for the script's file hash and set the action to 'Allow'

Delete the script from the host

Disable the Falcon sensor during script execution

Change the prevention policy to 'Block' for all scripts

A financial services company notices that Falcon is consuming excessive CPU on endpoints running a legacy portfolio management tool. The tool performs frequent, legitimate registry reads and file scans. The security team wants to reduce the performance impact while still detecting malicious activity that might use similar techniques. What should the administrator configure?

Move the legacy tool to a separate network segment with reduced Falcon monitoring.

Create an exclusion for the legacy tool's registry keys and file paths.

Disable the Falcon sensor's real-time protection on endpoints running the legacy tool.

Increase the frequency of Falcon's cloud-based scans for those endpoints.

A Falcon administrator receives numerous alerts for a legitimate software update process that is flagged as suspicious. The update is known to be benign. Which action best resolves the false positives while maintaining detection coverage?

Ignore the alerts and take no action

Increase the detection sensitivity to catch more activity

Create an exclusion for the update process's file path

Disable all detection rules globally

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 6Objective 2

6.2 Interpret Business Requirements in Order to Allow Trusted Activity, Resolve False Positives and Fix Performance Issues CCFA Practice Questions (Page 3)

Part of the Rules Configuration domain, which makes up ~13% of our current practice bank.

14questions here

3free pages

4concepts

Questions 11–14

11foundation · easy
A business unit reports that a critical application is being blocked by a Falcon prevention policy. The business requirement is to keep the application functional while maintaining security visibility. Which rule configuration action best aligns with this requirement?
Select an answer first
12foundation · easy
A company uses a custom script that performs administrative tasks. Falcon currently blocks the script, and the business wants to allow it without losing the ability to detect other threats. Which rule configuration best achieves this?
Select an answer first
13application · medium
A financial services company notices that Falcon is consuming excessive CPU on endpoints running a legacy portfolio management tool. The tool performs frequent, legitimate registry reads and file scans. The security team wants to reduce the performance impact while still detecting malicious activity that might use similar techniques. What should the administrator configure?
Select an answer first
14foundation · easy
A Falcon administrator receives numerous alerts for a legitimate software update process that is flagged as suspicious. The update is known to be benign. Which action best resolves the false positives while maintaining detection coverage?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

6.2 Interpret Business Requirements in Order to Allow Trusted Activity, Resolve False Positives and Fix Performance Issues CCFA Practice Questions (Page 3)

Questions 11–14

A business unit reports that a critical application is being blocked by a Falcon prevention policy. The business requirement is to keep the application functional while maintaining security visibility. Which rule configuration action best aligns with this requirement?

A company uses a custom script that performs administrative tasks. Falcon currently blocks the script, and the business wants to allow it without losing the ability to detect other threats. Which rule configuration best achieves this?

A Falcon administrator receives numerous alerts for a legitimate software update process that is flagged as suspicious. The update is known to be benign. Which action best resolves the false positives while maintaining detection coverage?

Keep studying — Rules Configuration