Login / Register Shopping Cart (0)

Home
All Vendors
Guarantee
FAQ
Testimonials

CrowdStrike Certified Falcon Administrator - CCFA-200 Exam Practice Test

Page: 1 / 13
Total 152 questions

Please signup / login to view this exam, then you will be able to view the entire exam for free.

Get Full Access Now

Question 1

What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

A. Trigger, condition(s) and action(s) B. Event trigger(s) C. For - While statement(s) D. Predefined workflow template(s)

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Which option allows you to exclude behavioral detections from the detections page?

A. IOC Exclusion B. IOA Exclusion C. Sensor Visibility Exclusion D. Machine Learning Exclusion

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

How do you assign a Prevention policy to one or more hosts?

A. Ensure the hosts are in a group and assign that group to a custom Prevention policy B. Modify the users roles on the User Management page C. Create a new policy and assign it directly to those hosts on the Host Management page D. Create a new policy and assign it directly to those hosts on the Prevention policy page

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Why is it important to know your company's event data retention limits in the Falcon platform?

A. Data such as process records are kept for a shorter time than event data B. This is not necessary; you simply select "All Time" in your query to search all data C. You will not be able to search event data into the past beyond your retention period D. Your query will require you to specify the data pool associated with the date you wish to search

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Which Real Time Response role will allow you to see all analyst session details?

A. None of the Real Time Response roles allows this B. Real Time Response -Administrator C. Real Time Response -Active Responder D. Real Time Response - Read-Only Analyst

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?

A. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution" B. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking. C. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow" D. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

How many "Auto" sensor version update options are available for Windows Sensor Update Policies?

A. 2 B. 1 C. 0 D. 3

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

A. Remediation Manager B. Real Time Responder C. Falcon Investigator D. Endpoint Manager

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

What can exclusions be applied to?

A. Individual hosts selected by the administrator B. Either all hosts or specified groups C. Only the default host group D. Only the groups selected by the administrator

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

A. Remediation Manager B. Real Time Responder - Read Only Analyst C. Real Time Responder - Active Responder D. Falcon Analyst - Read Only

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?

A. 90 Days B. 45 Days C. 60 Days D. 75 Days

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

A. TCP port 22 (SSH) B. TCP UDP port 53 (DNS) C. TCP port 80 (HTTP) D. TCP port 443 (HTTPS)

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Page: 1 / 13
Total 152 questions

Unlock all CCFA-200 features

No captcha needed
365 Days Free Updates
Set your Desired Pass Percentage
Allocate Time (Hours : Minutes)
Two Modes For CCFA-200 Practice
Customer Support

Get Full Access Now

0 Happy Clients

0 Shares

0 Downloads

0 Years in Business

Get in Touch

Latest Exams

NSE7_FSN_AR-7.6 Training Dumps
AI-200 Training Dumps
MS-102 Training Dumps
DEA-C01 Training Dumps
NS0-165 Training Dumps
NSE6_OTS_AR-7.6 Training Dumps

Useful Links

All Products
FAQ
Privacy Policy
Guarantee & Refund Policy
Terms & Conditions
How to buy?
About Us

Contact Us

Our Working Time: ( GMT 0:00-15:00 )
From Monday to Saturday

Support: Contact now

If you have any question please leave me your email address, we will reply and send email to you in 12 hours.

Copyright © 2026 TRAININGDUMP.COM. All rights reserved. All trademarks are the property of their respective owners and we don't provide actual questions from any vendor.