5.4 Understand the Functionality of a Containment Policy CCFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Falcon administrator is configuring a containment policy for a host group that includes a critical application server. The server cannot be isolated from the network for more than a few minutes without causing a business outage. The administrator wants to ensure that if the server is contained, it is automatically released after a short period. What should the administrator do?

   • ACreate a separate host group for the server and apply a policy with no network isolation.
   • BConfigure the containment policy to automatically release the host after a specified time period.
   • CSet the severity threshold to 'Critical' so the server is only contained on critical detections.
   • DExclude the server from the containment policy and rely on manual containment.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator needs to apply a containment policy to a host group that contains both Windows and Linux servers. The policy should isolate hosts from the network on high-severity detections. What should the administrator do?

   • ACreate a containment policy with network isolation enabled and assign it to each individual server in the group.
   • BCreate a containment policy with process termination enabled and assign it to the host group.
   • CCreate separate containment policies for Windows and Linux servers and assign each to the respective hosts.
   • DCreate a single containment policy with network isolation enabled and assign it to the host group.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the Falcon console, what type of setting is used to determine which hosts a containment policy applies to?

   • ADetection severity, which only applies the policy to hosts with critical detections
   • BGeographic region, which limits the policy to hosts in a specific location
   • CSensor version, which only applies the policy to hosts running a specific agent version
   • DHost groups, which allow the policy to be assigned to a collection of hosts
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to ensure that a containment policy is applied to all hosts in the 'Production' host group, but they also want to exclude a specific server that is known to have false positives. What should the administrator do?

   • ACreate a new containment policy with a higher severity threshold and assign it to the 'Production' group.
   • BAssign the containment policy to the 'Production' host group and then manually remove the server from the group.
   • CAssign the containment policy to individual hosts in the 'Production' group, excluding the specific server.
   • DCreate a separate host group for the excluded server and assign a different containment policy to that group.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   After a containment policy has been applied during an incident, what is a key aspect of monitoring its effectiveness?

   • AConfirming that the host's user has acknowledged the containment notification
   • BChecking the host's CPU usage to ensure the policy is not causing performance issues
   • CVerifying that the host's operating system is up to date with the latest patches
   • DReviewing detection and event data to see if the containment actions stopped the malicious activity
   Reveal Solution Discussion Select an answer first