CrowdStrike Exam CCFH-202 Topic 10 Question 23 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 23
Topic #: 10

You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

ACreate a custom alert for each domain

BAllowed Domain Summary Report

CBulk Domain Search

DIP Addresses Search

Show Suggested Answer

Suggested Answer: D

This is the correct answer for the same reason as above. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads. It does not display a listing of all Mac hosts with or without a Falcon sensor installed, nor does it provide a detection focused view of known malicious activities occurring on Mac hosts.

by Dominga at Jul 08, 2024, 12:57 AM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Justine

1 months ago

This is a tricky one, but I think the Allowed Domain Summary Report is the way to go. It's the most direct tool for the job.

upvoted 0 times

...

Teddy

1 months ago

Hmm, I'm not sure. I think I might try the IP Addresses Search first, just to see if I can get a more granular look at the specific hosts that have been accessing these domains.

upvoted 0 times