Free CCFA-200 Actual Exam Questions s - Question 14 Discussion
detection trends, policy changes, and sensor health. The goal is to create a recurring report that includes
key metrics and trends over time. What is the most appropriate method to accomplish this in the Falcon
console?
B/C? B handles detection trends and automated reports well, but C focuses on sensor health and detection data too. Combining insights from both might give a fuller picture over time.
Actually, I don’t think A is right because Real-Time Response is more about active remediation than reporting or tracking trends over time. D sounds like it could handle policy changes but doesn’t really touch on detection trends or sensor health, so it’s too narrow. C might be useful for sensor health but doesn’t cover detection trends or policy changes well. B seems to be the only option that can combine multiple metrics in one place and automate recurring reports, which fits the question’s requirements best.
B, since it covers detection trends and lets you automate reports, closest fit.
Maybe C focuses more on sensor health, but it might miss detection trends and policy changes.
Guessing B since it covers trends and can send recurring reports automatically.
B seems best for ongoing trend tracking and automated reporting via email.
D imo, because policy changes are a key part of what the admin wants to monitor, and the Policy Management app is designed to track and export those settings. While B might handle detection trends well, it doesn’t seem to cover policy changes or sensor health fully. C focuses more on sensor health but misses policy tracking. So, using D for policy changes combined with other tools might be the way to get a complete picture over time.
B/C? B covers detection trends and reporting but might miss full sensor health details, while C focuses more on sensor health and detection data but doesn't mention policy changes. Neither fully covers all goals alone.
Why isn’t there an option about setting up a custom report or scheduled report directly? That seems like an obvious way to get recurring updates on multiple metrics.