5.4 Understand the Functionality of a Containment Policy CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical action that a containment policy can perform on a compromised host?

   • AInstalling a new endpoint detection and response (EDR) agent on the host
   • BApplying operating system security patches to the host
   • CNetwork isolation, which blocks the host's ability to communicate with other systems
   • DDeleting the host's user profiles to remove attacker-created accounts
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Falcon administrator is reviewing the effectiveness of a containment policy that has been in place for several months. The policy is set to isolate hosts on high-severity detections. The administrator notices that the policy has been triggered frequently, but the incident response team reports that many of the detections were false positives. What should the administrator do to reduce the number of false positive containments?

   • ADisable the containment policy and rely on manual containment.
   • BIncrease the severity threshold to 'Critical' so that only critical detections trigger containment.
   • CKeep the policy as is and accept the false positives as a cost of security.
   • DReview the detection rules and adjust the policy to be more specific to actual threats.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Based on the results of monitoring an incident, an administrator decides to adjust a containment policy. What is a typical adjustment they might make?

   • AChanging the host's IP address to a different subnet
   • BChanging the response actions, such as adding process termination to a policy that only had network isolation
   • CDeleting the host from the Falcon console entirely
   • DModifying the host's firewall rules at the operating system level
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Besides network isolation, what other type of action can a containment policy be configured to take on a compromised host?

   • ARebooting the host to clear the memory of the malicious process
   • BChanging the host's local administrator password
   • CEncrypting all files on the host to prevent data exfiltration
   • DTerminating specific processes that are identified as malicious
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a host that has been contained. The analyst needs to determine if the containment policy terminated any processes. Where should the analyst look for this information?

   • ALook at the network traffic logs to see if the host was isolated.
   • BContact the incident response team to ask if any processes were terminated.
   • CCheck the host's local event viewer for process termination events.
   • DReview the detection details and event logs for the host in the Falcon console.
   Reveal Solution Discussion Select an answer first