5.6 Understand Options and Requirements to Manage Quarantined Files CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of file quarantine in CrowdStrike Falcon?

   • ATo permanently delete malicious files from all endpoints immediately upon detection
   • BTo isolate potentially malicious files in a secure location so they cannot execute while allowing analysis or restoration
   • CTo automatically send copies of suspicious files to third-party sandboxes for analysis
   • DTo encrypt files on endpoints to protect them from unauthorized access
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon administrator is troubleshooting why a quarantined file cannot be restored from the Falcon console. The file was detected on a Windows endpoint that has been decommissioned and removed from the host management list. What is the most likely reason the restore action fails?

   • AThe quarantine feature was disabled after the file was quarantined.
   • BThe file's quarantine record is still present, but the endpoint is no longer available to receive the restore command.
   • CThe file was quarantined by a different prevention policy that does not allow restore.
   • DThe administrator does not have the 'Quarantine Management' permission.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst notices that a file was quarantined on a Windows endpoint, but the endpoint's sensor was offline at the time of detection. The analyst wants to understand how the quarantine was applied. What should the analyst know about Falcon's quarantine behavior in this scenario?

   • AThe file was only blocked, not quarantined, because the sensor was offline.
   • BThe file was not quarantined because the sensor requires cloud connectivity to initiate quarantine.
   • CThe sensor quarantined the file locally and will sync the quarantine record to the cloud when connectivity is restored.
   • DThe file was quarantined by the cloud and the sensor will apply the quarantine when it reconnects.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following actions can an administrator perform on a quarantined file in the Falcon console?

   • AConvert the file to a safe format
   • BMove the file to a different endpoint
   • CRestore the file to its original location
   • DModify the file's contents directly in the console
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What configuration is required in a prevention policy to enable quarantine as a response action?

   • ASet the detection response action to 'Quarantine' for the relevant malware or exploit prevention setting
   • BAssign the 'Quarantine Admin' role to the policy creator
   • CInstall the Falcon sensor in 'Quarantine Mode'
   • DEnable the 'Auto-Restore' toggle in the policy settings
   Reveal Solution Discussion Select an answer first