Exam CCFA topic 1 question 136 discussion

When you select disable detection for a Host in the Host Management section, the shown message is the following: "You are about to disable detections for HOSTNAME. By doing so, detections will stop being generated on this host and all existing detections for this host will be hidden from the Falcon Host UI. This data will be restored to the UI if you re-enable detections on this host. Are you sure you want to disable detections for HOSTNAME?" So yeah, the correct one is C. The detections for the host are removed from the console immediately and no new detections will display in the console going forward

D. Existing detections for the host remain, but no new detections will display in the console going forward This action does not affect prevention mechanisms; they continue to operate as configured. Disabling detections simply stops new detection alerts from appearing in the console for the specified host.

ITS D tested on the UI.

Disable detections You are about to disable detections for XXXXXXX. By doing so, detections will stop being generated on this host and all existing detections for this host will be hidden from the Falcon Host UI. This data will be restored to the UI if you re-enable detections on this host. Are you sure you want to disable detections for XXXXXX? Tested in console now

Below is the pop up when u click on "Disable Detection": You are about to disable detections for XXXXXXXXX. By doing so, detections will stop being generated on this host and all existing detections for this host will be removed from the Falcon Host UI. This data cannot be restored to the UI later, even if you re-enable detections on this host. Are you sure you want to disable detections for XXXXXXXXXXX?

C is correct

C is correct

C is correct

C correct, existing detections gone too