CrowdStrike Certified Falcon Administrator (CCFA) — Question 211

Which report in Falcon can be used to determine the volume of blocked activity at a different prevention policy setting?

Answer options

• A. Prevention Policy Audit Trail
• B. Sensor Visibility Exclusions Audit
• C. Machine Learning Prevention Monitoring
• D. Falcon Prevention Policy Debug

Correct answer: C

Explanation

The Machine Learning Prevention Monitoring report is specifically designed to provide insights into the amount of blocked activities based on different prevention policy settings, making it the correct choice. The other options focus on auditing or debugging rather than monitoring blocked activity volume.