Free CrowdStrike Certified Falcon Administrator Exam CCFA-200 Exam Practice Test

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

• Remediation Manager
• Real Time Responder -- Read Only Analyst
• Falcon Analyst -- Read Only
• Real Time Responder -- Active Responder

Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

• TCP port 22 (SSH)
• TCP port 443 (HTTPS)
• TCP port 80 (HTTP)
• TCP UDP port 53 (DNS)

You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

• Prevention Policy Audit Trail
• Prevention Policy Debug
• Prevention Hashes Ignored
• Machine-Learning Prevention Monitoring

What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

• To group hosts with others in the same business unit
• To group hosts according to the order in which Falcon was installed, so that updates are installed in the same order every time
• To prioritize the order in which Falcon updates are installed, so that updates are not installed all at once leading to network congestion
• To allow the controlled assignment of sensor versions onto specific hosts

Which role allows a user to connect to hosts using Real-Time Response?

• Endpoint Manager
• Falcon Administrator
• Real Time Responder -- Active Responder
• Prevention Hashes Manager

How long are detection events kept in Falcon?

• Detection events are kept for 90 days
• Detections events are kept for your subscribed data retention period
• Detection events are kept for 7 days
• Detection events are kept for 30 days

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

• Configure a Real Time Response policy allowlist with the specific IP addresses
• Configure a Containment Policy with the specific IP addresses
• Configure a Containment Policy with the entire internal IP CIDR block
• Configure the Host firewall to allowlist the specific IP addresses

What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

• Falcon console updates are pending
• Falcon sensors installing an update
• Notifications have been disabled on that host sensor
• Microsoft updates

Which of the following is NOT an available filter on the Hosts Management page?

• Hostname
• Username
• Group
• OS Version

When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

• Create a Dynamic Group with Type=Workstation Assignment
• Create a Dynamic Group and Import All Workstations
• Create a Static Group and Import all Workstations
• Create a Static Group with Type=Workstation Assignment