After a containment policy has been in place for a week, the incident response team reports that the policy is too aggressive and is containing hosts that are not actually compromised. The administrator needs to adjust the policy to reduce false positives. What should the administrator do?

Increase the severity threshold required to trigger containment.

Disable the containment policy and rely on manual containment.

Remove the containment policy from the host group and apply it to individual hosts.

Change the containment action from network isolation to process termination.

When configuring a containment policy in the Falcon console, which of the following elements is part of the policy configuration?

Specifying the email server used for alert notifications

Selecting the response actions, such as network isolation or process termination

Defining the log retention period for the host's event data

Choosing the operating system image used for host reimaging

Which of the following is a valid way to apply a containment policy to a host in the Falcon console?

Running a PowerShell script on the host to activate the policy

Sending a direct email to the host's user with instructions to enable the policy

Assigning the policy to a host group that the host belongs to

Uploading a configuration file to the host's file system

In the context of incident response, what is the main goal of isolating a host with a containment policy?

To allow the host to continue operating normally while the investigation proceeds

To prevent the host from communicating with other systems, thereby stopping the spread of the attack

To ensure the host's data is backed up before any remediation steps are taken

To identify the root cause of the compromise by analyzing network traffic

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 5Objective 4

5.4 Understand the Functionality of a Containment Policy CCFA Practice Questions (Page 4)

Part of the Policy Application domain, which makes up ~17% of our current practice bank.

19questions here

4free pages

5concepts

Questions 16–19

16application · medium
After a containment policy has been in place for a week, the incident response team reports that the policy is too aggressive and is containing hosts that are not actually compromised. The administrator needs to adjust the policy to reduce false positives. What should the administrator do?
Select an answer first
17foundation · easy
When configuring a containment policy in the Falcon console, which of the following elements is part of the policy configuration?
Select an answer first
18foundation · easy
Which of the following is a valid way to apply a containment policy to a host in the Falcon console?
Select an answer first
19foundation · easy
In the context of incident response, what is the main goal of isolating a host with a containment policy?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.