CrowdStrike Certified Falcon Administrator (CCFA) — Question 77

How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

Answer options

• A. By ensuring each user has set the "pop-ups allowed" in their User Profile configuration page
• B. By enabling "Upload quarantined files" in the General Settings configuration page
• C. By turning on the "Notify End Users" setting at the top of the Prevention policy details configuration page
• D. By selecting "Enable pop-up messages" from the User configuration page

Correct answer: C

Explanation

The correct answer is C because enabling the 'Notify End Users' setting ensures that users are informed when actions are blocked, killed, or quarantined by the Falcon sensor. Options A and D pertain to user-specific settings that do not impact the functionality of notifications related to the sensor's actions, while option B is unrelated to user notifications.