Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
exam questions

Exam CCFA All Questions

View all questions & answers for the CCFA exam

Exam CCFA topic 1 question 7 discussion

Actual exam question from CrowdStrike's CCFA
Question #: 7
Topic #: 1
[All CCFA Questions]

Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

  • A. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  • B. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
  • C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  • D. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
vsnt89
2 months, 3 weeks ago
Selected Answer: C
C is correct.
upvoted 1 times
...
sbag0024
1 year, 5 months ago
Selected Answer: C
C is correct
upvoted 1 times
...
FerbOP
1 year, 7 months ago
Selected Answer: C
C is correct
upvoted 1 times
...
Reddington0214
1 year, 9 months ago
Selected Answer: C
C is a possibe answer, however when you created a new RTR Rules, the default setting is disabled and you will just add the host group For D that is also possible> However, the option is to add host name rather than host group.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...