5.4 Understand the Functionality of a Containment Policy CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Where in the Falcon console would an administrator go to apply a containment policy to a specific host group?

   • AThe 'Policy' or 'Host Groups' management section, where policies are assigned to groups
   • BThe 'Dashboard' page, where you can view overall system health
   • CThe 'Detection' details page, where you can manually apply a policy to a single detection
   • DThe 'Sensor Download' page, where you can configure the agent's behavior
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of applying a containment policy to a compromised host in CrowdStrike Falcon?

   • ATo isolate the host from network communication to prevent lateral movement and limit further damage
   • BTo permanently delete all malicious files from the host's disk
   • CTo increase the host's logging verbosity for deeper forensic analysis
   • DTo automatically reimage the host with a known-good operating system image
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   After a containment policy was applied to a host group, the incident response team reports that a critical server is now unable to reach a necessary internal database, causing a business outage. The server was contained due to a false positive. The administrator needs to restore service while maintaining some level of protection. What should the administrator do?

   • ADisable the containment policy entirely for the host group.
   • BIncrease the severity threshold of the containment policy to 'Critical' so the server is no longer contained.
   • CRemove the server from the containment policy and apply a less restrictive policy that only terminates known malicious processes.
   • DLeave the containment in place and wait for the incident to be resolved.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has a host group for 'Finance Workstations' and another for 'Executive Devices'. A new containment policy is created to isolate hosts that show signs of credential theft. The administrator wants the policy to apply to both groups but with different severity levels. What is the most efficient way to achieve this?

   • ACreate a new host group that includes hosts from both groups and apply a single policy to it.
   • BAssign the policy to individual hosts within both groups, setting severity per host.
   • CCreate one containment policy and assign it to both host groups, using the same severity level.
   • DCreate two separate containment policies, one for each host group, with the appropriate severity levels.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A Falcon administrator is configuring a containment policy for a host group that includes a server running a legacy application. The application requires network access to a specific database server to function. The administrator wants to contain the host if it is compromised but allow it to communicate with the database server. What should the administrator do?

   • ACreate a separate host group for the server and apply a policy with no containment actions.
   • BConfigure the containment policy to allow traffic to the specific database server while isolating all other traffic.
   • CExclude the server from the containment policy and rely on manual containment.
   • DDisable network isolation and rely on process termination only.
   Reveal Solution Discussion Select an answer first