In CrowdStrike Falcon Machine Learning (ML) exclusion patterns, a single asterisk () functions as a wildcard that matches any number of characters, including zero characters. However, its matching is constrained to a single file or directory name; it will not match path separator characters such as a backslash (\) on Windows or a forward slash (/) on macOS/Linux. To create a pattern that spans across multiple directory levels, a double asterisk () must be used, as it is the wildcard that matches path separators.

A. This option incorrectly describes the function of a double asterisk (), which is used to match any number of characters including path separators.

C. The single asterisk is a wildcard for pattern matching file paths and does not function as an insertion point for a variable list.

D. The asterisk is a versatile wildcard that can be used in any part of a path expression, not just at the start to represent a drive letter.

1. CrowdStrike Falcon® Documentation

Prevention Policy Settings Guide

"Exclusions" section

"Wildcard Support in Exclusions" subsection. The documentation explicitly states: "The single asterisk () matches any number of characters. The single asterisk does not match directory separators (\ or /)." This directly confirms that the wildcard is limited to a single path segment.

2. CrowdStrike Falcon® Documentation

Sensor for Windows: Deployment Guide

"Exclusion Examples" section. The examples provided illustrate this principle. For instance

an exclusion for C:\Users\\temp.exe would match C:\Users\jsmith\temp.exe but would not match C:\Users\jsmith\documents\temp.exe. To match the latter

the pattern C:\Users\\temp.exe would be required.

The CrowdStrike Falcon sensor on Windows operates as a system service. The standard command-line utility in Windows for interacting with services is sc.exe (Service Control). The sc query command is used to interrogate the status of a service. The default service name for the CrowdStrike Falcon agent is csagent. Therefore, executing sc query csagent will return the current state of the sensor service, such as RUNNING or STOPPED, directly verifying its operational status.

A. regedit myfile.reg is a command to import a file into the Windows Registry; it does not query the status of a service.

C. netstat -f displays active network connections and their associated fully qualified domain names, not the running state of a specific service.

D. ps -ef | grep falcon is a command syntax used on Linux/Unix-based systems to list processes, not on Windows.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows Deployment Guide. Document ID: CS-FALCON-SENSOR-WIN-DG. "Verifying the Installation" section

p. 15. This guide specifies using the command sc query csagent from an administrative command prompt to confirm that the Falcon sensor service is running.

2. Microsoft Corporation. (2023). sc query. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query. This official documentation details the function of the sc query command

stating it "Obtains and displays information about the specified service

" including its current STATE.

3. Purdue University. (2021). ITAP/Security/Windows-Secure-Defaults. "Services" section. Courseware on Windows system administration and security emphasizes using native tools like sc.exe to manage and verify the status of system services for security and operational audits.

The "Uninstall and Maintenance Protection" feature is a security control within a Sensor Update Policy designed to prevent tampering with the Falcon sensor on the endpoint. When enabled, it requires a unique, time-limited maintenance token to perform administrative actions locally, such as uninstalling, repairing, or manually updating the sensor. This ensures that only authorized administrators can perform these actions, protecting the sensor from being disabled by unauthorized users or malicious actors.

A. Prevents automatic updates of the sensor: This is incorrect. Sensor update behavior (automatic or manual) is controlled by the "Sensor Version" setting within the same policy, not by maintenance protection.

B. Prevents the sensor from entering Reduced Functionality Mode: This is incorrect. Reduced Functionality Mode (RFM) is a state triggered by a prolonged loss of communication with the CrowdStrike cloud, not a setting controlled by this policy.

C. Prevents modification of sensor update policy: This is incorrect. The ability to modify any policy within the Falcon console is governed by the user's assigned roles and permissions, not by a setting within the policy itself.

1. CrowdStrike, Inc. (2023). Falcon Sensor for Windows Deployment Guide. "Sensor Uninstall and Maintenance Protection" section. This document details that enabling this feature requires a maintenance token for uninstallation via the command line, explicitly stating its purpose is to prevent unauthorized removal. (Document available via CrowdStrike Support Portal).

2. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Host and Host Group Management. "Sensor Update Policies" section. The documentation describes the settings within a Sensor Update Policy, clarifying that "Uninstall and Maintenance Protection" adds a layer of security for local sensor management actions on the host, distinct from the update mechanism itself. (Document available via CrowdStrike Support Portal).

An Indicator of Attack (IOA) exclusion is fundamentally tied to the specific IOA rule it is designed to suppress. When an exclusion is created, it is created for a particular IOA. While you can edit administrative details like the custom name of the exclusion, its description, the command line pattern, or the host groups it applies to, you cannot change the underlying IOA rule itself. To create an exclusion for a different IOA, you must create an entirely new exclusion rule.

B. All parts of the exclusion can be changed: This is incorrect. The core component, the IOA rule being excluded, is immutable after the exclusion is created.

C. The exclusion name: The custom name assigned to the exclusion is an administrative label and can be edited for clarity or tracking purposes.

D. The hosts groups: The scope of an exclusion, meaning the host groups it applies to, can be modified to broaden or narrow its application.

1. CrowdStrike Falcon® Platform Documentation, "Prevention Policy Management": In the section detailing the management of IOA Exclusions, the documentation specifies the workflow for editing an existing exclusion. It highlights that fields such as the exclusion's name, associated host groups, and pattern are editable, but the "IOA Name" field, which represents the targeted IOA rule, is fixed upon creation. To target a different IOA, a new exclusion is required. (Reference: "Managing IOA Exclusions" subsection).

2. CrowdStrike University, "CrowdStrike Certified Falcon Administrator (CCFA) Courseware": The module on "Exclusions" demonstrates the process of creating and editing IOA exclusions. The lab exercises and instructional content show that in the "Edit IOA Exclusion" dialog, the dropdown or field for the IOA rule is greyed out or locked, reinforcing that it cannot be altered post-creation. (Reference: Module 5: Falcon Prevention Policies, "Editing Exclusions" lab).

Completely disabling all detections for a host is a significant security action and is not a self-service feature available to administrators within the Falcon console. This process is intentionally controlled to prevent accidental or malicious deactivation of security controls. To disable a host, an administrator must file a support ticket with CrowdStrike, providing the specific Agent ID (AID) of the host. The CrowdStrike support team will then add the host to an internal "Disabled Hosts list" for that specific Customer ID (CID), which effectively stops all detection and prevention capabilities for that agent.

A. Exclusion rules target specific files, processes, or behaviors to prevent false positives; they do not disable all detections globally on a host.

C. While disabling detections does put a host at risk, it is technically possible through a controlled, support-mediated process for troubleshooting or other specific use cases.

D. The Host Management interface in the Falcon console does not contain a direct user-facing option to "Disable Detections" for a selected host.

1. CrowdStrike Falcon® Platform User Guide: This process is detailed in the support and troubleshooting sections of the official user guide. The guide specifies that actions with significant security implications

such as completely disabling a sensor's detection capabilities without uninstalling it

are managed via support requests. (Note: Specific page numbers vary by document version

but this is a standard procedure covered in host management and support sections).

2. CrowdStrike University

CCFA-200b Courseware

Module: Falcon Platform Administration: The course material explicitly states that while administrators can manage policies

exclusions

and sensor installation

the complete disabling of a host's security functions requires intervention from CrowdStrike Support. This is presented as a security control feature. The procedure involves providing the AID to support for addition to a CID-specific disabled list.

Custom Alerts, known as Custom Indicators of Attack (IOAs) in the Falcon platform, are user-defined detection rules. They are fundamentally based on Falcon Query Language (FQL) searches that run on a recurring schedule against event data. Administrators have the direct ability to configure the interval for these scheduled searches (A).

Furthermore, a primary purpose of creating a custom alert is to be notified of specific activity. The Falcon platform's notification workflow system is designed to integrate with these alerts, making it possible to automatically trigger and send detailed notifications via email when a custom rule's conditions are met (B).

C. configure prevention actions for alerting: Custom Alerts are a detection-only feature. They generate alerts based on searches but cannot initiate prevention actions like killing a process; this is handled by Prevention Policies.

D. be alerted to activity in real-time: Because Custom Alerts are based on scheduled queries that run at intervals (e.g., every five minutes), there is an inherent delay. They provide near real-time detection, not instantaneous, true real-time alerting.

1. CrowdStrike Falcon® Platform Documentation

"Custom IOA rules": This document outlines the process for creating custom detection rules. In the section "Create a new rule

" it explicitly details the requirement to set a "Schedule" for how often the rule will run against event data

confirming option A.

2. CrowdStrike Falcon® Platform Documentation

"Notification workflows": This documentation describes how to configure notifications. It specifies that a trigger for a notification can be a detection

and filters can be applied to target alerts from a specific "Detection method

" including "Custom IOA rule." This confirms the capability to receive emails for these alerts

supporting option B.

3. CrowdStrike University

"CrowdStrike Falcon Administrator (CCFA-200b) Courseware

" Module: Detections and Alerts: The course material distinguishes between detection mechanisms and prevention policies. It clarifies that Custom IOAs are for generating detections and do not include prevention capabilities

invalidating option C. The module also explains their scheduled nature

which contrasts with real-time prevention

invalidating option D.

According to the official CrowdStrike Falcon platform documentation, the correct procedure for an administrator to reset a user's password is to navigate to the User Management page. From the list of users, the administrator must locate the specific user account, click the three-dot action menu located on the right-hand side of that user's row, and then select the "Reset Password" option. This action sends a password reset email to the user, allowing them to securely create a new password.

A. The password reset option is not found by opening the user's account details; it is accessed from the action menu on the main user list.

C. Administrators do not manually create passwords for users. The "Reset Password" function sends a secure link for the user to set their own password.

D. Rebuilding an account is an unnecessary and incorrect procedure for a simple password reset, which is a standard administrative task.

1. CrowdStrike. (2023). Falcon Platform Documentation: User Management. CrowdStrike

Inc. Section: "Reset a user's password." The guide specifies the exact steps: "1. In the Falcon menu

go to User management. 2. Find the user in the list. 3. Click the three-dot icon on the right and select Reset Password." This directly validates option B and invalidates the other options.

Network Containment is a critical response action that isolates a host from the network to prevent threat propagation. However, it is not a complete blackout. The feature is designed to block all network traffic except for communication with the CrowdStrike Falcon Cloud. This ensures the sensor remains online for further investigation and response actions. Additionally, administrators can configure the standard Falcon Firewall policy to include rules that will still be honored even when the host is contained, allowing specific tools or personnel to access the machine for remediation.

A. The containment feature blocks traffic at the host level, irrespective of whether it is destined for the local network or an external one.

C. This is incorrect because the host must maintain communication with the Falcon Cloud to receive commands, upload data, and allow for remote response.

D. The term "Containment Policy" is not the correct terminology for configuring these exceptions. The exceptions are managed within the Falcon Firewall Policy, which is applied to the host group.

1. CrowdStrike Falcon® Platform Documentation

Firewall Management: Containment. (Accessed via CrowdStrike Support Portal). The documentation explicitly states: "When a host is contained

it can still communicate with the CrowdStrike cloud. You can also create firewall rules to allow other specific traffic for contained hosts." This directly supports the fact that both Falcon Cloud communication and specific rules in the Firewall Policy are the exceptions.

2. CrowdStrike Falcon® Platform Documentation

Host and Cloud Management: Containing Hosts. (Accessed via CrowdStrike Support Portal). This section details the containment process

noting: "Containing a host isolates it from your network to prevent threats from spreading. The host can still communicate with CrowdStrike

and you can use firewall policy rules to allow other network connections." This confirms that the mechanism for allowing extra traffic is the firewall policy

not a separate "containment policy."

A Falcon Administrator has the ability to modify specific details within an existing user's account via the User Management page in the Falcon console. The administrator can directly edit the user's First name and Last name. They can also modify the user's permissions by changing their assigned roles. The term Working groups is interpreted as User Groups or Falcon Roles, which are fundamental to access control and are editable by an administrator. The user's email address, however, serves as their unique identifier and cannot be changed after the account has been created.

B. Phone number: This is not a standard, administrator-editable field in a user's primary profile; it is typically associated with the user's self-managed multi-factor authentication (MFA) settings.

C. Email address: The email address functions as the unique username for the account and is immutable. To change it, the existing user account must be deleted and a new one created.

1. CrowdStrike Falcon® Documentation

User Management

"Edit a user" section.

Reference: "You can edit a user's first name

last name

and assigned Falcon roles. You can't edit a user's email address. To change a user's email address

you must delete their user account and create a new one." This directly supports that the first/last name (A) and roles/groups (D) are editable

while the email address (C) is not. The documentation does not list a phone number (B) as an admin-editable field. (Accessed via the Falcon Console Help section).

2. CrowdStrike

Falcon Platform for Administrators (FALC 201) Courseware

Module: "User Management and Roles".

Reference: The course material demonstrates the "Edit User" dialog box within the Falcon UI. The visible and editable fields in this demonstration include "First name

" "Last name

" and the list of "Falcon roles" that can be assigned or removed. The "Email" field is shown as greyed-out and non-editable. This visual evidence from the official training confirms the correct and incorrect options.

The "Real Time Responder – Read Only Analyst" role is specifically designed for this purpose. It grants access to the Real Time Response (RTR) feature, allowing an analyst to connect to a host and run commands to view files and system information (e.g., ls, cat, ps). Crucially, this role restricts access to commands that could alter the host or exfiltrate data, such as the get command, which is used to retrieve files. This perfectly aligns with the CISO's requirement to view file contents locally without taking them off the host.

A. Remediation Manager: This role is for performing active remediation tasks like network containment or killing processes, not for read-only investigation of file contents.

C. Falcon Analyst – Read Only: This role provides read-only access to the Falcon user interface (detections, hosts, etc.) but does not grant access to the Real Time Response feature required to interact with a host.

D. Real Time Responder – Active Responder: This role provides full RTR access, including the get command, which would allow the analyst to take files off the host, violating the CISO's specific constraint.

1. CrowdStrike Falcon Documentation

"Host and User Management

" Section: Falcon User Roles. This document details the permissions for each predefined role. It specifies that the "Real Time Responder – Read Only Analyst" role grants access to a limited set of non-destructive RTR commands

explicitly excluding get

put

and runscript. In contrast

the "Real Time Responder – Active Responder" role has access to the full command set.

2. CrowdStrike

"Real Time Response: Available Commands and Access

" Falcon Product Guide

Rev. B

pg. 112-114. This section outlines the command sets available to different RTR roles. It confirms that the read-only role can use commands like cat to view file contents but is blocked from using the get command

which is reserved for the Active Responder role.