Free CrowdStrike Certified Falcon Administrator Exam CCFA-200 Exam Practice Test

Which of the following is TRUE of the Logon Activities Report?

• Shows a graphical view of user logon activity and the hosts the user connected to
• The report can be filtered by computer name
• It gives a detailed list of all logon activity for users
• It only gives a summary of the last logon activity for users

Why is it important to know your company's event data retention limits in the Falcon platform?

• This is not necessary; you simply select 'All Time' in your query to search all data
• You will not be able to search event data into the past beyond your retention period
• Data such as process records are kept for a shorter time than event data
• Your query will require you to specify the data pool associated with the date you wish to search

Which is the correct order for manually installing a Falcon Package on a macOS system?

• Install the Falcon package, then register the Falcon Sensor via the registration package
• Install the Falcon package, then register the Falcon Sensor via command line
• Register the Falcon Sensor via command line, then install the Falcon package
• Register the Falcon Sensor via the registration package, then install the Falcon package

What can the Quarantine Manager role do?

• Manage and change prevention settings
• Manage quarantined files to release and download
• Manage detection settings
• Manage roles and users

On which page of the Falcon console would you create sensor groups?

• User management
• Sensor update policies
• Host management
• Host groups

Which option allows you to exclude behavioral detections from the detections page?

• Machine Learning Exclusion
• IOA Exclusion
• IOC Exclusion
• Sensor Visibility Exclusion

How are user permissions set in Falcon?

• Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions
• Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments
• An administrator selects individual granular permissions from the Falcon Permissions List during user creation
• Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?

• Maintenance token
• Customer ID (CID)
• Bulk update key
• Agent ID (AID)

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

• Configure a Real Time Response policy allowlist with the specific IP addresses
• Configure a Containment Policy with the specific IP addresses
• Configure a Containment Policy with the entire internal IP CIDR block
• Configure the Host firewall to allowlist the specific IP addresses

You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

• Specific sensor version number
• Auto - TEST-QA
• Sensor version updates off
• Auto - N-1