CCFA Study guides, Class notes & Summaries

How long are inactive sensors retained for in the Host Management Page and visible in the inactive sensors page? : 45 Days What happens when you undo a release from quarantine? : The Falcon sensor treats the file as malicious again. The next time the file attempts to execute, the sensor blocks and quarantines it again. What is IOC Management used for? : To allowlist executables as a compensating control for false positives or to reduce noise. Where can you locate a list of MacOS host...

CCFA Practice Exam Questions and Answers 100% Pass How long are inactive sensors retained for in the Host Management Page and visible in the inactive sensors page? 45 Days What happens when you undo a release from quarantine? The Falcon sensor treats the file as malicious again. The next time the file attempts to execute, the sensor blocks and quarantines it again. What is IOC Management used for? To allowlist executables as a compensating control for false positives or to reduce...

What is the function of a single asterisk (*) in an ML exclusion pattern? A. The single asterisk will match any number of characters, including none. It does include separator characters, such as or /, which separate portions of a file path B. The single asterisk will match any number of characters, including none. It does not include separator characters, such as or /, which separate portions of a file path C. The single asterisk is the insertion point for the variable list that foll...