ExamTopics Logo
Mail Us[email protected]
Menu
Crowdstrike Discussions
exam questions

Exam CCFA All Questions

View all questions & answers for the CCFA exam
Go to Exam

Exam CCFA topic 1 question 11 discussion

Actual exam question from CrowdStrike's CCFA
Question #: 11
Topic #: 1
[All CCFA Questions]

How do you disable all detections for a host?

  • A. Create an exclusion rule and apply it to the machine or group of machines
  • B. Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
  • C. You cannot disable all detections on individual hosts as it would put them at risk
  • D. In Host Management, select the host and then choose the option to Disable Detections
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by Reddington0214 at Feb. 4, 2023, 5:25 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Armful
6 days, 22 hours ago
Selected Answer: A
Can only block these IOCs on mobile devices.
upvoted 1 times
...
vsnt89
8 months ago
Selected Answer: D
It's the option D, checked.
upvoted 1 times
...
Rahul29
1 year, 9 months ago
i dont see any option is HostManagement to disable it.
upvoted 1 times
vsnt89
8 months ago
Once you are in Host Management, click on any host, then go to the 3 dots in the right end and you will find this option on the menu.
upvoted 1 times
...
...
sbag0024
1 year, 10 months ago
Selected Answer: D
D is correct , tested in the UI
upvoted 1 times
...
andreiushu
2 years, 2 months ago
Selected Answer: D
D is the correct answer
upvoted 1 times
...
Reddington0214
2 years, 2 months ago
Selected Answer: D
D is the correct answer, Tested on Falcon Console
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago