An administrator wants to enable a CID-wide setting that affects all hosts. Where would they make this change?

In the response policy for the CID

In the prevention policy assigned to each host group

In the sensor update policy for the CID

In the General Settings page under Settings

A Falcon administrator is configuring CID-wide management settings in General Settings. The organization has a parent CID and multiple child CIDs. The administrator wants to enforce a uniform 'Default Detection Status' of 'New' and disable 'Allow users to create custom detection rules' across all child CIDs. Which actions should the administrator take? (Select all that apply.)

Create a new role that denies custom rule creation and assign it to all users.

Set the 'Default Detection Status' to 'New' in General Settings.

Use the API to update the default status in each child CID individually.

Disable 'Allow users to create custom detection rules' in General Settings.

A Falcon administrator needs to access CID-wide management settings in General Settings to configure the 'Default Detection View' and 'Default Detection Status'. Which of the following steps are required to access and configure these settings? (Select all that apply.)

Navigate to 'Hosts' > 'Host Groups' and select 'CID-wide settings'.

Select the 'CID-wide management' section within General Settings.

Navigate to 'Detections' > 'Detection Settings' and click 'CID-wide'.

Navigate to 'Settings' > 'General Settings' in the Falcon console.

A Falcon administrator needs to quickly access the CID-wide management settings to check if a specific option is enabled. The administrator is currently on the 'Detections' page. What is the most direct navigation path to reach General Settings?

Click on the 'Settings' icon in the left navigation menu, then select 'General Settings'.

Click on the 'Hosts' icon in the left navigation menu, then select 'General Settings'.

Click on the 'Dashboard' icon in the left navigation menu, then select 'General Settings'.

Click on the 'Detections' icon in the left navigation menu, then select 'General Settings'.

An organization wants to restrict the ability of analysts to export detection data to prevent data leakage. The administrator needs to enforce this restriction across all child CIDs. What should the administrator configure in General Settings?

Ask each child CID administrator to disable export in their local settings.

Create a new role that denies export permissions and assign it to all users.

Disable the 'Allow data export' option in CID-wide management settings.

Use a host group to restrict export capabilities on specific hosts.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 6Objective 4

6.4 Understand Configurations for CID Wide Management Within General Settings CCFA Practice Questions (Page 2)

Part of the Rules Configuration domain, which makes up ~13% of our current practice bank.

17questions here

4free pages

4concepts

Questions 6–10

6foundation · easy
An administrator wants to enable a CID-wide setting that affects all hosts. Where would they make this change?
Select an answer first
7expert · hard · select all that apply
A Falcon administrator is configuring CID-wide management settings in General Settings. The organization has a parent CID and multiple child CIDs. The administrator wants to enforce a uniform 'Default Detection Status' of 'New' and disable 'Allow users to create custom detection rules' across all child CIDs. Which actions should the administrator take? (Select all that apply.)
Select an answer first
8application · medium · select all that apply
A Falcon administrator needs to access CID-wide management settings in General Settings to configure the 'Default Detection View' and 'Default Detection Status'. Which of the following steps are required to access and configure these settings? (Select all that apply.)
Select an answer first
9application · easy
A Falcon administrator needs to quickly access the CID-wide management settings to check if a specific option is enabled. The administrator is currently on the 'Detections' page. What is the most direct navigation path to reach General Settings?
Select an answer first
10application · medium
An organization wants to restrict the ability of analysts to export detection data to prevent data leakage. The administrator needs to enforce this restriction across all child CIDs. What should the administrator configure in General Settings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.