Updated CrowdStrike CCFA-200 Dumps (V12.03) – Explore the Latest CCFA-200 Exam Questions & Get Remarkable Scores in the CrowdStrike Certified Falcon Administrator (CCFA) Exam

1. An analyst has reported they are not receiving workflow triggered notifications in the past few days.

Where should you first check for potential failures?

2. How are user permissions set in Falcon?

3. When creating new IOCs in IOC management, which of the following fields must be configured?

4. Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group.

What is the next step to disable RTR only on these hosts?

5. Which exclusion pattern will prevent detections on a file at C:Program FilesMy ProgramMy Filesprogram.exe?

6. Once an exclusion is saved, what can be edited in the future?

7. Why is the ability to disable detections helpful?

8. What impact does disabling detections on a host have on an API?

9. What is the purpose of using groups with Sensor Update policies in CrowdStrike Falcon?

10. What command should be run to verify if a Windows sensor is running?

11. Under the "Next-Gen Antivirus: Cloud Machine Learning" setting there are two categories, one of them is "Cloud Anti-Malware" and the other is:

12. What is the purpose of precedence with respect to the Sensor Update policy?

13. Which is the correct order for manually installing a Falcon Package on a macOS system?

14. When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?

15. Which of the following Machine Learning (ML) sliders will only detect or prevent high confidence malicious items?

16. You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes.

Which of the following parameters can be used to override the 20 minute default provisioning window?

17. Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host.

What is the most appropriate role that can be added to fullfil this requirement?

18. Which option allows you to exclude behavioral detections from the detections page?

19. Which role will allow someone to manage quarantine files?

20. When a host is placed in Network Containment, which of the following is TRUE?

21. How do you disable all detections for a host?

22. In order to quarantine files on the host, what prevention policy settings must be enabled?

23. What is the maximum number of patterns that can be added when creating a new exclusion?

24. Which of the following is TRUE of the Logon Activities Report?

25. You have created a Sensor Update Policy for the Mac platform.

Which other operating system(s) will this policy manage?

26. You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints.

What is the best way to prevent these in the future?

27. What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

28. When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

29. Which role allows a user to connect to hosts using Real-Time Response?

30. Where can you modify settings to permit certain traffic during a containment period?

31. Which of the following is a valid step when troubleshooting sensor installation failure?

32. How many "Auto" sensor version update options are available for Windows Sensor Update Policies?

33. Where in the Falcon console can information about supported operating system versions be found?

34. Under which scenario can Sensor Tags be assigned?

35. How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

36. One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called "devcode."

What setting can you use to reduce false positives on this file path?

37. What is the primary purpose of using glob syntax in an exclusion?

38. Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?

39. On a Windows host, what is the best command to determine if the sensor is currently running?

40. Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host.

Which role do you need added to your user account to have this capability?

41. Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

42. What type of information is found in the Linux Sensors Dashboard?

43. How long are detection events kept in Falcon?

44. What can the Quarantine Manager role do?

45. How do you find a list of inactive sensors?

46. The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks.

Which statement is TRUE concerning Falcon sensor certificate validation?

47. You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message.

What is the best way to update the workflow?

48. You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this.

Which is the best way to accomplish this?

49. Which is a filter within the Host setup and management > Host management page?

50. How do you assign a Prevention policy to one or more hosts?

51. Where do you obtain the Windows sensor installer for CrowdStrike Falcon?

52. Which of the following applies to Custom Blocking Prevention Policy settings?

53. An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

54. Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

55. What information is provided in Logan Activities under Visibility Reports?