5.6 Understand Options and Requirements to Manage Quarantined Files CCFA Practice Questions (Page 3)

Questions 11–12

1. 11foundation · easy

   What happens when an administrator deletes a quarantined file from the Falcon console?

   • AThe file is permanently removed from the endpoint and cannot be recovered
   • BThe file is moved to the Recycle Bin on the endpoint
   • CThe file is marked as 'deleted' but remains accessible for 30 days
   • DThe file is sent to CrowdStrike for further analysis
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A Falcon administrator is reviewing a detection where a file was quarantined. The administrator wants to confirm that the file was actually removed from the endpoint's file system. Where should the administrator look to verify this?

   • AThe event search page, which shows all detection events.
   • BThe detection details page, which shows the file's hash and path.
   • CThe host management page, which shows the sensor's last seen time.
   • DThe quarantine list, which shows the file's status as 'Quarantined'.
   Reveal Solution Discussion Select an answer first