EMT Practice Test

1. Question Content...

---

Question1: Which is the correct order for manually installing a Falcon Package on a macOS system?

Question2: Which role will allow someone to manage quarantine files?

Question3: You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes. Which of the following parameters can be used to override the 20 minute default provisioning window?

Question4: What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

Question5: What is the function of a single asterisk (*) in an ML exclusion pattern?

Question6: How do you assign a Prevention policy to one or more hosts?

Question7: When would the No Action option be assigned to a hash in IOC Management?

Question8: When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?

Question9: Which exclusion pattern will prevent detections on a file at C:\Program Files\My Program\My Files\program.exe?

Question10: An analyst is asked to retrieve an API client secret from a previously generated key. How can they achieve this?

Question11: You have created a Sensor Update Policy for the Mac platform. Which other operating system(s) will this policy manage?

Question12: What is the maximum number of patterns that can be added when creating a new exclusion?

Question13: What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

Question14: Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

Question15: Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

Question16: You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?

Question17: You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

Question18: When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

Question19: Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

Question20: What command should be run to verify if a Windows sensor is running?

Question21: How does the Unique Hosts Connecting to Countries Map help an administrator?

Question22: How do you assign a policy to a specific group of hosts?

Question23: Which of the following is NOT a way to determine the sensor version installed on a specific endpoint?

Question24: If a user wanted to install an older version of the Falcon sensor, how would they find the older installer file?

Question25: With Custom Alerts, it is possible to __________.

Question26: Which role allows a user to connect to hosts using Real-Time Response?

Question27: Which of the following best describes the Default Sensor Update policy?

Question28: Which of the following is a valid step when troubleshooting sensor installation failure?

Question29: On which page of the Falcon console would you create sensor groups?

Question30: Which of the following Machine Learning (ML) sliders will only detect or prevent high confidence malicious items?

Question31: Why is it important to know your company's event data retention limits in the Falcon platform?

Question32: The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

Question33: One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called "devcode." What setting can you use to reduce false positives on this file path?

Question34: While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?