Câu 57: CCFA: CrowdStrike Certified Falcon Administrator

Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

1. A. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
2. B. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
3. C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group — đáp án hiện tại
4. D. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"