A responder is explaining the quarantine process to a system administrator.

CrowdStrike CCFR-201b Question Answer

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

It is deleted from the disk and a log is sent to the cloud.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

CCFR-201b PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"