A company is deploying Falcon to a mixed environment of Windows and macOS endpoints. The security team wants to enable quarantine for all endpoints. What should the administrator verify before enabling the quarantine feature?

All endpoints are joined to the same Active Directory domain.

All endpoints have at least 10 GB of free disk space for the quarantine store.

All endpoints have the Falcon sensor installed with a valid license.

All endpoints are running a sensor version that supports quarantine.

Which of the following is a prerequisite for the quarantine feature to work in CrowdStrike Falcon?

The endpoint must be connected to a domain controller

The endpoint must run a specific operating system version

The Falcon sensor must be installed and running on the endpoint

The Falcon console must be accessed via a VPN

A Falcon administrator is managing a quarantine incident where a file was detected on 50 endpoints. The administrator needs to restore the file on all endpoints simultaneously, but only for the specific file hash. What is the most efficient way to accomplish this in the Falcon console?

Use the quarantine list, filter by the file hash, select all matching entries, and choose 'Restore'.

Create a new prevention policy with an exclusion for the file hash and apply it to all hosts.

Use the API to delete the detections and then re-run the sensor on all hosts.

Select each endpoint individually and restore the file from each host's quarantine list.

A Falcon administrator needs to remove a quarantined file from a single endpoint because the user has confirmed it is malicious and no longer needed. The administrator wants to ensure the file is permanently removed from the system and the quarantine store. What is the correct action in the Falcon console?

Select the file in the quarantine list and choose 'Delete'.

Select the file and choose 'Restore' to return it to the original location.

Select the file and choose 'Allow' to add it to the allowlist.

Select the file and choose 'Submit for analysis' to send it to the sandbox.

A Falcon administrator is investigating a detection on a Windows server. The detection details show that a file was quarantined. The administrator wants to verify the original file path and the timestamp of when the file was quarantined. Where in the Falcon console should the administrator look?

The Event Search page, using the 'Quarantine' event type.

The Prevention Policy page, under the 'Quarantine' section.

The Detection details page, under the 'Quarantine' tab.

The Host Management page, under the 'Quarantine' column.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 5Objective 6

5.6 Understand Options and Requirements to Manage Quarantined Files CCFA Practice Questions (Page 1)

Part of the Policy Application domain, which makes up ~17% of our current practice bank.

12questions here

3free pages

4concepts

Questions 1–5

1application · medium
A company is deploying Falcon to a mixed environment of Windows and macOS endpoints. The security team wants to enable quarantine for all endpoints. What should the administrator verify before enabling the quarantine feature?
Select an answer first
2foundation · easy
Which of the following is a prerequisite for the quarantine feature to work in CrowdStrike Falcon?
Select an answer first
3application · medium
A Falcon administrator is managing a quarantine incident where a file was detected on 50 endpoints. The administrator needs to restore the file on all endpoints simultaneously, but only for the specific file hash. What is the most efficient way to accomplish this in the Falcon console?
Select an answer first
4application · easy
A Falcon administrator needs to remove a quarantined file from a single endpoint because the user has confirmed it is malicious and no longer needed. The administrator wants to ensure the file is permanently removed from the system and the quarantine store. What is the correct action in the Falcon console?
Select an answer first
5application · easy
A Falcon administrator is investigating a detection on a Windows server. The detection details show that a file was quarantined. The administrator wants to verify the original file path and the timestamp of when the file was quarantined. Where in the Falcon console should the administrator look?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.