CrowdStrike Certified Falcon Administrator - 2024 Version (CCFA-200b) Free Practice Test

Question 1

You are tasked with creating a "Workstations" host group to encompass all workstations in your environment.
Which dynamic grouping criteria will most efficiently accomplish this task?

A. Platform Windows

B. Grouping Tags Workstation

C. OU Workstation

D. Type: Workstation

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

What default user role can manage API credentials?

A. Falcon API Manager

B. Falcon Security Lead

C. Endpoint Manager

D. Falcon Administrator

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

What is an example of when you will need to refer to your Customer ID+ Checksum (CIDC)?

A. When installing a new Falcon Sensor

B. When defining host group assignment criteria

C. When uninstalling a Falcon Sensor

D. When you need to find a specific host in Host Management

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which report provides a filterable high-level overview of host information such as OS version, Device Type and Machine Domain, and also provides an active sensor heat map for a quick environment review?

A. Sensor Status Report

B. Sensor Policy Daily Report

C. Sensor Report

D. Sensor Overview Report

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Using Host setup and management inside the Falcon Console, how can you display sensors in Reduced Functionality Mode?

A. From Sensor status, click on the widget RFM

B. From Sensor health, sort using the column heading Sensor status

C. From Host management, filter for RFM

D. From Host status, filter for RFM

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group. What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

A. The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers

B. The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

C. The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers

D. The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

What is the primary purpose of audit logs in Falcon?

A. Trace file changes

B. Track configuration changes

C. Monitor system performance

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which report would show you an overview of the top ten most-applied policies by sensors in your environment?

A. Sensor policy daily report

B. Executive summary

C. Sensor report dashboard

D. Scheduled reports

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

Your leadership wants controls in place for immediate action on any OverWatch detections. What should you do to ensure the host is contained quickly and notifies the appropriate staff?

A. Create a Fusion SOAR workflow using the OverWatch playbook to contain the host and email the SOC team

B. Create a Fusion SOAR workflow to trigger on an OverWatch detection and set it to block the detection

C. Create a Fusion SOAR workflow to create a detection for OverWatch and email the SOC team

D. Create a Fusion SOAR workflow to contain the host and email the OverWatch team

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CrowdStrike Certified Falcon Administrator - 2024 Version (CCFA-200b) Free Practice Test