How do you find a list of inactive sensors?

• A.The Falcon platform does not provide reporting for inactive sensors
• B.Run the Sensor Aging Report within the Investigate option
• C.Run the Inactive Sensor Report in the Host setup and management option
• D.A sensor is always considered active until removed by an Administrator

Comment: *

Name: *

Email: *

Verification: *

You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?

• A.Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"
• B.Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.
• C.Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
• D.Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"

Comment: *

Name: *

Email: *

Verification: *

How do you disable all detections for a host?

• A.Create an exclusion rule and apply it to the machine or group of machines
• B.Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
• C.You cannot disable all detections on individual hosts as it would put them at risk
• D.In Host Management, select the host and then choose the option to Disable Detections

Comment: *

Name: *

Email: *

Verification: *

Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

• A.Real Time Responder
• B.Endpoint Manager
• C.Falcon Investigator
• D.Remediation Manager

Comment: *

Name: *

Email: *

Verification: *

What type of information is found in the Linux Sensors Dashboard?

• A.Hosts by Kernel Version, Shells spawned by Root, Wget/Curl Usage
• B.Hidden File execution, Execution of file from the trash, Versions Running with Computer Names
• C.Versions running, Directory Made Invisible to Spotlight, Logging/Auditing Referenced, Viewed, or Modified
• D.Private Information Accessed, Archiving Tools - Exfil, Files Made Executable

Comment: *

Name: *

Email: *

Verification: *