Exam CCFA topic 1 question 243 discussion

Actual exam question from CrowdStrike's CCFA

Question #: 243
Topic #: 1

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group.

What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

A. The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy
B. The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers
C. The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers
D. The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

Show Suggested Answer

Suggested Answer: B 🗳️

by CiscoNoahexamtopic at June 4, 2025, 1:14 p.m.

Comments

Submit Cancel

CiscoNoahexamtopic

1 week, 6 days ago

Selected Answer: B

B is correct When a host belongs to more than one group, Falcon evaluates all assigned sensor update policies in aggregate and applies the one with the highest precedence (i.e., the lowest numerical value). Since your “Test Windows Servers” group is a subset of your “All Windows Servers” group, you must ensure the test‐group’s policy has higher priority than the general group’s policy.

upvoted 1 times

...