When detections are disabled for a host, the Falcon sensor on that endpoint stops creating and reporting new detection events to the CrowdStrike cloud. The DetectionSummaryEvent is the specific event type generated and sent via the Streaming API whenever a new detection occurs. Therefore, a direct impact on the API is that the stream of DetectionSummaryEvents for that particular host will cease until detections are re-enabled, as no new detections are being generated to trigger these events.

A. This is a true statement about the general effect on the host, but it is not the most specific answer regarding the impact on the API itself.

B. This is factually incorrect. Detections can be disabled for individual hosts or groups of hosts through the "Sensor Visibility Exclusions" feature in the Falcon console.

D. This is incorrect. Disabling detections is a persistent state that remains active until manually re-enabled; it does not have a default 24-hour time limit.

1. CrowdStrike

Inc. (2023). Falcon Event Streams Documentation. CrowdStrike Support Portal. In the "Event Dictionary" section

the DetectionSummaryEvent is defined as the event created when a new detection is triggered. Disabling detections on a host prevents this trigger condition.

2. CrowdStrike

Inc. (2023). Falcon Platform User Guide. CrowdStrike Support Portal. The "Host Management" chapter details the "Sensor Visibility Exclusions" feature

explaining that it can be applied to individual hosts to "suppress detection notifications

" which directly stops the creation of events that would be sent to the API.

3. CrowdStrike

Inc. (2023). CCFA-200b Falcon Administrator Courseware. Module: "Host and Sensor Management". This module explicitly covers the functionality of Sensor Visibility Exclusions

confirming that they can be applied to individual hosts and that their purpose is to stop the generation of new detections

which logically halts the corresponding API events.

Custom alerts within the CrowdStrike Falcon platform, formally known as Custom Indicators of Attack (IOAs), are created by defining rules that act as triggers. These rules monitor the real-time stream of endpoint event data for specific, user-defined patterns of behavior. When a sequence of events matches the logic defined in the custom rule, the trigger is activated, and a custom alert is generated. This allows security teams to create tailored detections for threats, compliance requirements, or suspicious activities unique to their environment, supplementing CrowdStrike's built-in detections.

A. Custom workflows are automated response actions that can be initiated after an alert is generated, not the basis for the alert itself.

C. Predefined alert templates may serve as a starting point, but the core of a custom alert is the unique, user-defined logic, not the pre-existing template.

D. CrowdStrike Falcon uses its proprietary Falcon Query Language (FQL) for searching and defining rules, not Splunk's Search Processing Language (SPL).

---

1. CrowdStrike

Inc. (2023). Falcon Platform: Custom IOAs. CrowdStrike Falcon Documentation.

Section: "Creating a rule"

Reference: The documentation explicitly states

"A rule is composed of a pattern that describes the behavior you want to detect... When Falcon observes the pattern on a host

it triggers a detection." This confirms that custom alerts are based on event-driven patterns that act as triggers.

2. CrowdStrike

Inc. (2023). Falcon Platform: Event Data Dictionary. CrowdStrike Falcon Documentation.

Section: "Introduction to Falcon Events"

Reference: This document outlines the various event types (e.g.

ProcessRollup2

DnsRequest

NetworkConnectIP4) that serve as the foundational data source. Custom IOA rules are built by creating logic that triggers on specific values and sequences within these event types.

3. Purdue University. (n.d.). CS 42600: Computer Security

Lecture 19: Intrusion Detection. Purdue University Courseware.

Reference: This course material discusses intrusion detection systems

explaining that modern systems often rely on "behavior-based" or "anomaly-based" detection. This involves defining rules or models of behavior and generating alerts when events deviate or match a malicious pattern

which is the core principle behind CrowdStrike's custom event-based triggers.

The CrowdStrike Falcon platform has a built-in data retention policy to manage host inventory. A host is considered inactive if its sensor has not communicated with the Falcon cloud for an extended period. By default, any host that remains inactive for 45 consecutive days is automatically removed from the Host Management view in the Falcon console. This process, often referred to as sensor aging, ensures that the list of managed hosts remains current and accurate, reflecting only actively protected endpoints.

B. 60 Days: This is an incorrect timeframe. The standard inactivity period before automatic removal is 45 days, not 60.

C. 30 Days: This is an incorrect timeframe. While some systems use a 30-day cycle, Falcon's default is longer at 45 days.

D. 90 Days: This is an incorrect timeframe. The platform removes inactive hosts much sooner than 90 days to maintain a clean inventory.

1. CrowdStrike Falcon Platform Documentation, Host and sensor management: In the section detailing the sensor lifecycle and host inventory, the documentation specifies the automatic removal policy. It states, "To keep your host inventory current, hosts that have been inactive for 45 days are automatically removed from the Falcon console." (Note: This documentation is typically available to customers via the Falcon support portal).

2. CrowdStrike University, CCFA-200b Falcon Administrator Courseware, Module: Host and Sensor Management: The course material explicitly covers host lifecycle management. It details that hosts are marked as inactive and subsequently removed from the console after a 45-day period of no contact with the Falcon cloud. This is presented as a key administrative feature for maintaining environment hygiene.

Within a CrowdStrike Falcon Prevention Policy, the "Next-Gen Antivirus" section contains settings for "Cloud Machine Learning." This feature leverages the CrowdStrike cloud to analyze files and determine if they are malicious. It is configured using two distinct categories for detection and prevention levels: "Cloud Anti-Malware" for malicious files and "Adware & PUP" for potentially unwanted programs. These settings allow administrators to tune the aggressiveness of cloud-based detections for different types of threats.

B. Advanced Machine Learning: This is a specific setting found under the "On-Sensor ML" section of the prevention policy, not the "Cloud Machine Learning" section.

C. Sensor Anti-Malware: This refers to the on-sensor detection capabilities, which are configured separately from the cloud-based machine learning settings within the prevention policy.

D. Execution Blocking: This is a prevention action that can be triggered by a detection, not a category of detection within the "Cloud Machine Learning" settings.

1. CrowdStrike, Inc. (2023). Falcon Prevention and Response: Prevention Policy Settings Guide. CrowdStrike Documentation Portal. In the "Next-Gen Antivirus" section, under the subsection "Cloud Machine Learning," the guide explicitly lists the two configurable categories as "Cloud Anti-Malware" and "Adware & PUP." (Note: Access to this portal typically requires a customer account).

In the CrowdStrike Falcon platform, policies are applied to groups of hosts, not individual hosts directly. To apply a policy to a specific, pre-defined set of hosts, the correct procedure is to first create a host group using the "Static Assignment" method. This allows you to manually select and add the exact hosts you want in the group. Once the static group is created and saved, you then navigate to the desired prevention policy, go to its "Assigned Host Groups" tab, and associate that newly created group with the policy. This ensures the policy settings are applied exclusively to the hosts you explicitly selected.

B. This describes creating and assigning a dynamic group. While a valid workflow, "Static Assignment" is the direct method for a specific, manually selected list of hosts as implied by the question.

C. This option incorrectly describes the process. The criteria for a dynamic group (OU, OS, etc.) are defined when creating the group, not when assigning the group to a policy.

D. This workflow is incorrect. Policies cannot be assigned directly to individual hosts from the policy assignment tab; they must be assigned to a host group.

1. CrowdStrike Falcon® Platform Documentation

Host groups. This document details the two methods for creating host groups: dynamic and static. The "Static assignment" section explicitly describes the process of manually selecting hosts to form a group. It states

"For static assignment

you can search for and add hosts to the group." This aligns with the first step in option A.

2. CrowdStrike Falcon® Platform Documentation

Prevention Policies. This documentation explains how policies are managed and applied. In the section covering policy assignment

it specifies that policies are enabled for hosts by adding host groups to the policy's "Assigned Host Groups" list. The procedure described is to "Go to Configuration > Prevention Policies... Select a policy... Click the Assigned Host Groups tab... Click Add groups to policy." This confirms the second part of the workflow described in option A.

Dynamic Host Groups automatically assign hosts based on defined criteria. Using an assignment rule such as OS contains 'Workstation' or a similar platform-specific filter for "Type=Workstation" is the most efficient and scalable method. This ensures that all current hosts that are workstations, as well as any new workstations that come online in the future, are automatically added to the group without manual intervention. This "set and forget" approach best fulfills the requirement to ensure all workstations are included over time.

B. Create a Dynamic Group and Import All Workstations: This is incorrect because hosts cannot be manually imported into a Dynamic Group; they are populated exclusively by automated assignment rules.

C. Create a Static Group and Import all Workstations: This is not the best method because it is a one-time action. The group would not automatically update to include new workstations added to the environment later.

D. Create a Static Group with Type=Workstation Assignment: This is incorrect because Static Groups are for manual host assignment only and do not support automated assignment rules like "Type=Workstation".

1. CrowdStrike Falcon® Platform Documentation, Host and host group management. The documentation specifies that Dynamic Groups are used to automatically group hosts based on their attributes. It states, "Dynamic host groups automatically include hosts that match criteria you define... This is useful for applying policies to hosts with certain characteristics, like all of your Windows workstations." This directly supports using a dynamic group with an assignment rule for this purpose.

2. CrowdStrike Training Material, CrowdStrike Falcon® Platform for Administrators (CCFA-200b) Student Guide. In the module covering Host Management, the guide differentiates between static and dynamic groups. It emphasizes that dynamic groups are the preferred method for grouping hosts by attributes like operating system or role to ensure policies are applied consistently and automatically as the environment changes. The creation of a dynamic group based on OS type is a standard lab exercise in this course.

The CrowdStrike Falcon platform automatically categorizes hosts based on their operating system and role. On the Host Management page (Host setup and management > Hosts), the "Type" filter is the designated tool for sorting devices by these categories. This filter allows an administrator to quickly view all systems identified as "Workstation," "Server," "Domain Controller," or other specific roles, streamlining management and policy application for different types of endpoints.

A. Status: This filter is used to identify hosts based on their sensor's connection state (e.g., online, offline, stale), not the device's functional role.

B. Platform: This filter sorts by the base operating system (e.g., Windows, macOS, Linux), which can include both workstations and servers without distinction.

C. Hostname: This is a search field used to find a specific, individual host by its unique name, not to filter for a category of devices.

1. CrowdStrike Falcon® Platform Documentation, "Host Management": In the section describing the user interface for host management, the documentation details the available filters. The "Type" filter is explicitly defined for categorizing hosts. An administrator can select "Workstation" from the "Type" dropdown menu to display all hosts that match this classification. (Accessed via the official CrowdStrike Support Portal, Falcon Platform Documentation).

2. CrowdStrike, "Getting Started with the Falcon Platform" Courseware: Module 3, "Host and Sensor Management," demonstrates the features of the Host Management page. The interactive labs and video tutorials show the use of the "Type" filter to isolate workstations from servers for tasks like group assignment and policy review. (Accessed via CrowdStrike University).

The Quarantine Manager role in the CrowdStrike Falcon platform is a specialized role designed with the principle of least privilege in mind. Its permissions are strictly limited to managing files that the Falcon sensor has quarantined. An individual with this role can view the list of quarantined files across the environment and perform two key actions: release a file from quarantine back to its original location on the host or download a copy of the quarantined file for offline analysis. This role does not have permissions to alter security policies, manage detections, or administer users.

A. Managing prevention settings is the responsibility of the Prevention Policy Manager or Falcon Administrator roles, not the Quarantine Manager.

C. Managing detection settings is a high-level permission granted to roles like Falcon Administrator, which have broader control over the platform's security posture.

D. Managing roles and users is a distinct administrative function assigned to the User Administrator or Falcon Administrator roles.

1. CrowdStrike. (2023). Falcon Documentation: User Management. CrowdStrike

Inc. In the "About Roles" section

the documentation explicitly defines the permissions for built-in roles. The Quarantine Manager role is described as: "Can manage quarantined files. This includes releasing files from quarantine and downloading them for analysis." This directly confirms the capabilities listed in the correct answer and excludes the capabilities listed in the incorrect options.

The most effective and standard method to resolve false positives for a specific, known-good binary within the CrowdStrike Falcon platform is to use IOC Management. By adding the SHA256 hash of the custom binary and setting the action to "Allow," you are creating a specific exception. This instructs the Falcon sensor on all endpoints to trust this file, preventing it from being flagged by Machine Learning or other detection engines in the future. This approach is precise, immediate, and scalable across the entire environment without weakening overall security posture.

A. Contacting support is inefficient for this task. The Falcon console provides self-service tools like IOC Management specifically for administrators to handle such common occurrences.

C. The "Block, hide detection" action would prevent the legitimate custom binary from executing, which is the opposite of the desired outcome and would cause an operational disruption.

D. The "No Action" setting would still generate detection alerts for the binary, merely preventing a block. This fails to solve the core problem of receiving numerous false positive alerts.

1. CrowdStrike Falcon® Platform Documentation

"Managing IOCs": This section details the functionality of IOC Management. It explicitly states that to create an exception for a file that is being incorrectly detected (a false positive)

an administrator should upload its hash (SHA256) and apply an "Allow" policy. This action functions as a whitelist

preventing future detections and blocks for that specific file. (Reference: Falcon UI > IOC Management section).

2. CrowdStrike University

"CrowdStrike Falcon Administrator (CCFA) Courseware": In the module covering Prevention Policies and Exclusions

the course material identifies IOC Management as the primary tool for creating granular exceptions. It specifies that using a file hash with an "Allow" action is the best practice for whitelisting legitimate applications that are causing false positive detections

particularly from the Machine Learning engine. (Reference: CCFA Course Module on "Exclusions and Whitelisting").

The "Real Time Responder – Active Responder" role is specifically designed within the CrowdStrike Falcon platform to grant users the necessary permissions to connect to hosts using the Real-Time Response (RTR) feature. This role allows a security analyst or administrator to establish a remote shell session to an endpoint to perform hands-on investigation and remediation. The "Active Responder" designation specifically includes permissions to execute commands that can modify the system, such as writing files, deleting files, and running scripts, in addition to read-only commands.

A. Endpoint Manager: This role is focused on managing sensor deployment, sensor update policies, and host groupings, not on direct, interactive response capabilities for individual hosts.

B. Falcon Administrator: While the Falcon Administrator role has broad permissions that likely include RTR access, it is a super-user role. The "Real Time Responder" is the specific, purpose-built role for this function, following the principle of least privilege.

D. Prevention Hashes Manager: This is a highly specialized role limited to managing custom IOCs (file hashes) for prevention policies and does not grant any remote access or response permissions.

1. CrowdStrike

Inc. (2023). CrowdStrike Falcon® Platform Documentation: User Management. "Roles and Permissions

" Section: Predefined Roles. This document details the specific capabilities of each built-in role

explicitly stating that the "Real Time Responder – Active Responder" role is required to "Connect to hosts and run all commands

including those that can modify a system."

2. CrowdStrike

Inc. (2023). CCFA-200b Falcon Administrator Courseware. Module: "Managing Users and Roles." The course material distinguishes between administrative roles (like Endpoint Manager) and response-focused roles

identifying "Real Time Responder" as the primary role for using the Real-Time Response feature.