Practice CCFA-200 Exam Online

Question 1

The Falcon Administrator has created a new prevention policy to apply to the "Servers" group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?

A :

The new prevention policy should be enabled first

B :

Host type was not defined correctly within the prevention policy

C :

The "Servers" group already has a policy applied to it

D :

The "Servers" group must be disabled first

Answer: C

Question 2

What best describes the relationship between Sensor Update policies and Operating Systems?

A :

A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)

B :

Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions

C :

Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems

D :

Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies

Answer: A

Question 3

When the Notify End Users policy setting is turned on, which of the following is TRUE?

A : End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist

B : End users will be immediately notified via a pop-up that their machine is in-network isolation

C : End-users receive a pop-up notification when a prevention action occurs

D : End users will receive a pop-up allowing them to confirm or refuse a pending quarantine

Answer: C

Question 4

When would the No Action option be assigned to a hash in IOC Management?

A : When you want to save the indicator for later action, but do not want to block or allow it at this time

B : Add the indicator to your allowlist and do not detect it

C : There is no such option as No Action available in the Falcon console

D : Add the indicator to your blocklist and show it as a detection

Answer: A

Question 5

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

A : Base URL

B : Secret

C : Client ID

D : Client name

Answer: B

Name:	CrowdStrike Certified Falcon Administrator
Exam Code:	CCFA-200
Certification:	CrowdStrike Falcon
Vendor:	CrowdStrike
Total Questions:	164
Last Updated:	Apr 25, 2024

CrowdStrike CCFA-200