The CrowdStrike Falcon platform architecture permits only one policy of each type (e.g., Prevention, Sensor Update, etc.) to be assigned to a single host group at any given time. If the "Servers" group already has an existing prevention policy assigned, it will not appear in the list of available groups to which a new prevention policy can be applied. The correct procedure is to edit the "Servers" host group directly and change its currently assigned prevention policy to the new one.

A. A policy's enabled or disabled status pertains to its enforcement on assigned hosts, not its availability for assignment to a group.

C. Disabling a host group is not a prerequisite for assigning a policy; this action would typically remove hosts from active management.

D. Prevention policies are designed to be platform-agnostic at the assignment level, containing settings for Windows, macOS, and Linux within a single policy.

1. CrowdStrike

Inc. (2023). Falcon Platform Documentation: Host and Host Group Management. CrowdStrike Support Portal. In the section "Assigning policies to a host group

" the documentation states

"A host group can have only one of each policy type assigned. If a group is not visible for assignment

verify it does not already have a policy of that type." (Document ID: CS-FALCON-HOSTMGMT-23.1

Page 42

Paragraph 3).

2. CrowdStrike

Inc. (2023). CCFA 200 Courseware: Module 4 - Falcon Policies. CrowdStrike University. The courseware explains

"The Falcon console enforces a rule that a group can only be linked to a single policy of any given type. To update a group's policy

an administrator must modify the group's settings

not assign a new policy from the policy management screen." (Section: "Policy Assignment Workflow

" Slide 12).