CrowdStrike Certified Falcon Administrator (CCFA) — Question 140

Which of the following scenarios best describes when you would add IP addresses to the containment policy?

Answer options

• A. You want to automate the Network Containment process based on the IP address of a host
• B. A new group of analysts need to be able to place hosts under Network Containment
• C. Your organization has resources that need to be accessible when hosts are network contained
• D. Your organization has additional IP addresses that need to be able to access the Falcon console

Correct answer: C

Explanation

The correct answer is C because it highlights the need for certain resources to remain accessible even when hosts are contained, which justifies the addition of IP addresses to the policy. Option A focuses on automation, B discusses analyst permissions, and D pertains to access needs without emphasizing resource accessibility during containment.