38 free CrowdStrike CCFA-200b Certified Falcon Administrator practice questions from the CertStash pack of 153, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 38 free here, all 153 in the pack, and each step includes the one before it.
Get all 153 questions (US$39) · Download the first 10 as a PDF
Question 1
Where would you apply a configuration to allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained?
Show answer and explanation
Correct answer: B. Containment Policy
Network containment cuts a host off from everything except the Falcon cloud, which can also stop analysts from reaching remediation tools, DNS servers or other required infrastructure. To keep specific communication paths open during containment, an administrator lists the permitted IP addresses or CIDR ranges in a Containment Policy and assigns that policy to host groups. Contained hosts covered by the policy can then still talk to those addresses while all other traffic remains blocked, so the investigation and recovery work can continue without exposing the host to the wider network.
Why the other options are wrong
- A. IP Allowlist Management restricts which IP addresses may reach the Falcon console and APIs; it does not govern traffic from contained hosts.
- C. Response policies control Real Time Response capabilities such as commands and scripts, not the addresses a contained host can reach.
- D. A maintenance token protects the sensor against unauthorized uninstall or modification and has nothing to do with containment traffic.
Question 2
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
Show answer and explanation
Correct answer: D. 45 Days
Falcon automatically cleans up hosts that stop checking in so that the host inventory reflects the real environment. When a host has not contacted the Falcon cloud for 45 days, it is removed from the Host Management and Trash pages without any administrator action. This keeps decommissioned, reimaged or long-offline machines from cluttering host lists and reports. If the same machine later reconnects, its sensor checks in again and the host reappears, so the automatic removal does not require any reinstallation.
Why the other options are wrong
- A. 75 days is longer than the inactivity period after which Falcon automatically removes a host from these pages.
- B. 60 days does not match the automatic removal window, which is reached earlier.
- C. 90 days is double the actual inactivity period used for automatic removal.
Question 3
What prevention policy setting prevents sensor-related files, folders, and registry objects from being renamed or deleted?
Show answer and explanation
Correct answer: C. Sensor Tampering Protection
Sensor Tampering Protection is a prevention policy setting that defends the Falcon sensor itself. When it is enabled, attempts to rename, delete or otherwise alter the sensor's files, folders and registry objects are blocked, and attempts to stop or unload the sensor are prevented. This matters because attackers frequently try to disable endpoint security before carrying out the rest of an intrusion. Keeping the setting on ensures the sensor continues to collect telemetry and enforce prevention even against users or processes with elevated privileges.
Why the other options are wrong
- A. Host Modification Protection is not a Falcon prevention policy setting for protecting sensor files and registry objects.
- B. System Configuration Protection is not the setting that blocks renaming or deleting sensor-related objects.
- D. Sensor Modification Protection is not the name of the Falcon prevention policy setting that guards sensor components.
Question 4
There are a significant number of false positive detections from your developers that are getting blocked and quarantined by Falcon.
What Indicator of Compromise (IOC) action would be the best option?
Show answer and explanation
Correct answer: C. Detect Only (displayed as Detect only in the console)
Setting the custom IOC action to Detect Only stops Falcon from blocking and quarantining the developers' files while still generating a detection each time the indicator is seen. This removes the disruption to the developers' work but keeps visibility, so analysts can confirm over time that the activity really is benign and spot any misuse of the same hash. It is a measured response to a large volume of false positives: the impact on users ends immediately, yet the security team does not lose the record of activity that it would need if the files were ever abused.
Why the other options are wrong
- A. No_action stores the indicator without blocking or detecting, so the team loses all visibility into the activity.
- B. Prevent blocks execution, which is exactly what is causing the false-positive disruption for the developers.
- D. Allow silences the indicator entirely, giving up detection visibility that Detect Only retains while the files are validated.
Question 5
During a Windows system investigation via Real Time Response (RTR), an RTR Active Responder is unable to execute a custom PowerShell script for finding specific system artifacts.
What is likely restricting the responder from executing the PowerShell script?
Show answer and explanation
Correct answer: A. Custom Scripts is not enabled in the response policy
Real Time Response capabilities are controlled by the response policy assigned to the host as well as by the user's role. Running a custom PowerShell script from the script library, through commands such as runscript with a cloud file, depends on the Custom Scripts option being enabled in the response policy for that platform. RTR Active Responder already has permission to run custom scripts, so when the responder cannot execute one, the most likely cause is that the host's response policy has Custom Scripts turned off.
Why the other options are wrong
- B. Put-and-Run governs uploading and launching files with the put-and-run command, not executing custom PowerShell scripts.
- C. RTR Active Responder can run custom scripts; RTR Administrator is needed for put-and-run and for managing scripts and files.
- D. Script-Based Execution Monitoring is a prevention policy visibility setting and does not control RTR script execution.
Question 6
What page provides a count of new Reduced Functionality Mode (RFM) sensors by day?
Show answer and explanation
Correct answer: B. Sensor Health
The Sensor Health page is built to show the operational state of the sensor fleet, and Reduced Functionality Mode is one of its key measures. It charts newly reported RFM sensors over time, giving a count of new RFM hosts by day, along with related health information such as sensor versions and connectivity. Administrators use this trend to spot problems like unsupported kernel or operating system updates that push many hosts into RFM at once, and then drill into the affected hosts to remediate them.
Why the other options are wrong
- A. Hosts Overview summarizes the host inventory, such as platforms and versions, rather than tracking new RFM sensors by day.
- C. Activity Overview focuses on detection and incident activity, not on sensor operating modes.
- D. Support and resources links to documentation and support tools and does not report sensor health data.
Question 7
Which report would show you an overview of the top ten most-applied policies by sensors in your environment?
Show answer and explanation
Correct answer: D. Sensor policy daily report
The Sensor policy daily report is focused on how policies are distributed across the sensor fleet. It provides an overview of the most-applied policies, including the top ten policies by the number of sensors they are assigned to, so administrators can quickly confirm which configurations govern the bulk of their hosts. This helps verify that host groups and policy precedence are producing the intended coverage and highlights unexpected assignments, such as many hosts falling back to a default policy.
Why the other options are wrong
- A. Scheduled reports is a delivery mechanism for running reports on a schedule, not a report showing top applied policies.
- B. A sensor report dashboard is not the report that summarizes the ten most-applied policies across sensors.
- C. The executive summary gives a high-level view of detections and security posture, not policy assignment counts.
Question 8
What could cause your Windows host to be in Reduced Functionality Mode (RFM)?
Show answer and explanation
Correct answer: A. CrowdStrike has not certified the latest Windows update
A Windows sensor enters Reduced Functionality Mode when it is running on an operating system build that CrowdStrike has not yet certified for that sensor, which commonly happens right after a new Windows update is installed. In RFM the sensor limits what it does to avoid destabilizing the host, so prevention and visibility are reduced until compatible content is available. Once CrowdStrike certifies the update, or the sensor is updated to a supporting version, the host returns to normal operation.
Why the other options are wrong
- B. A misconfigured sensor update policy affects which sensor version is deployed but is not what triggers RFM on the host.
- C. Prevention policy settings change what Falcon blocks or detects; they do not place the sensor in RFM.
- D. Losing connectivity makes a host offline or inactive in the console, which is different from Reduced Functionality Mode.
Question 9
Where can you find the history of the successes and failures for any Fusion SOAR workflows?
Show answer and explanation
Correct answer: D. Workflow Execution log
Every time a Fusion SOAR workflow runs, Falcon records the run in the Workflow Execution log. Each entry shows which workflow was triggered, when it ran, and whether it succeeded or failed, and administrators can open a run to see the outcome of individual actions. This makes it the place to confirm that automation is working as intended and to troubleshoot runs where an action did not complete, such as a failed notification or a containment step that could not be applied.
Why the other options are wrong
- A. The Falcon UI audit trail records user actions in the console, not the run-by-run results of workflows.
- B. Custom Alert History is not where Fusion SOAR workflow outcomes are recorded.
- C. A workflow audit log would track changes to workflow definitions rather than the success or failure of each run.
Question 10
What is the purpose of the Machine-Learning Prevention Monitoring Audit Log?
Show answer and explanation
Correct answer: C. It is designed to show malicious processes that would have been blocked in your environment based on different Machine-Learning Prevention settings
The Machine-Learning Prevention Monitoring view helps administrators tune machine learning settings before enforcing them. It shows processes that would have been blocked in the environment at different machine learning prevention levels, based on observed activity. By reviewing this, an administrator can see how many detections a more aggressive setting would produce and whether those hits are legitimate business software, then choose prevention levels that improve protection without causing excessive false positives.
Why the other options are wrong
- A. Reviewing and releasing quarantined items is done on the Quarantined Files page, not the prevention monitoring view.
- B. Monitoring real preventions for spikes and targeted attacks is a detection activity, not the purpose of this tuning view.
- D. It does not summarize configured aggressiveness levels and quarantine counts; it models what different settings would block.
Question 11
Which statement best describes user permissions in Falcon?
Show answer and explanation
Correct answer: C. User permissions can be defined by default or custom roles as needed
Falcon controls what a user can see and do through roles. Administrators can assign the predefined default roles that CrowdStrike provides, such as Falcon Administrator or Falcon Analyst - Read Only, or they can build custom roles that combine only the specific permissions a job function needs. Either approach can be used as needed, and users can hold multiple roles, which gives organizations the flexibility to apply least privilege without being locked into one model.
Why the other options are wrong
- A. Custom roles exist only within your own Falcon customer environment and are never shared with other CrowdStrike customers.
- B. There is no requirement to hold a default role before a custom role can be assigned; either type can be assigned directly.
- D. Permissions are granted through roles rather than by selecting each individual permission when the account is created.
Question 12
From the Host management page, what is the BEST field to filter by for Domain Controllers to obtain sensor version information?
Show answer and explanation
Correct answer: B. Type
In Host Management, the Type field classifies each Windows host by its role, such as Workstation, Server or Domain Controller. Filtering on Type and selecting Domain Controller isolates exactly those systems, after which the Sensor Version column shows what each one is running. This is the most direct way to scope the view to domain controllers, since none of the other fields identify a host's role in the domain. The filtered list can then be compared against sensor update policy targets or exported for reporting.
Why the other options are wrong
- A. Sensor Version shows the sensor build but cannot tell which hosts are domain controllers.
- C. Platform separates Windows, Mac and Linux and would include every Windows host, not just domain controllers.
- D. OS Version identifies the operating system release, which servers and domain controllers can share, so it does not isolate domain controllers.
Question 13
You need to look up a Red Hat Enterprise Linux (RHEL) system in Host Management.
What filter would apply?
Show answer and explanation
Correct answer: B. OS version
Host Management offers several filters for narrowing the host list. To find a Red Hat Enterprise Linux system specifically, the OS version filter applies, because it identifies the particular operating system distribution and release a host is running. This lets you isolate RHEL hosts rather than every Linux host, which is useful for targeted troubleshooting, reporting or policy checks.
Why the other options are wrong
- A. Platform groups hosts broadly as Windows, Mac or Linux and does not distinguish RHEL from other Linux distributions.
- C. Type distinguishes host roles such as workstation or server, not the operating system distribution.
- D. OU filters by Active Directory organizational unit, which does not identify the operating system.
Question 14
When an API client is created, what two pieces of information must be generated as a pair to successfully identify and validate your API integrations?
Show answer and explanation
Correct answer: B. Client ID and Secret
Creating an API client in the Falcon console generates a Client ID and a Secret. The two work together as a credential pair: the integration presents both to the OAuth2 token endpoint to obtain an access token, which it then uses for its API calls. The Client ID identifies the integration and the Secret proves it is authorized. The Secret is displayed only when the client is created or reset, so it must be stored securely at that time.
Why the other options are wrong
- A. There is no Integration ID; the Customer ID identifies the tenant rather than an individual API client.
- C. The Customer ID identifies the Falcon tenant and is not part of the generated API client credential pair.
- D. OAuth2 is the authentication method, not a separate generated ID; the pair is the Client ID and Secret.
Question 15
What is true about the Default Sensor Policy?
Show answer and explanation
Correct answer: B. It is applied automatically if no other Sensor Policies are applied
Each policy type in Falcon includes a default policy that acts as a catch-all. When a host is not a member of any host group assigned to a custom policy of that type, the default policy applies to it automatically. This guarantees that every host always has settings in effect, even before an administrator has placed it in a group. Because the default policy is the fallback, it should be configured with sensible baseline settings rather than left in an unreviewed state.
Why the other options are wrong
- A. The default policy is not a testing mechanism; it is the fallback for hosts with no other policy assigned.
- C. The default policy cannot be used to reset sensor settings to defaults; it is simply another policy that can be edited.
- D. The default policy is not tied to deploying the oldest supported sensor version; it is the catch-all for unassigned hosts.
Question 16
Which setting inside the Sensor Update Policy prevents unauthorized uninstallation?
Show answer and explanation
Correct answer: C. Uninstall and Maintenance Protection
Uninstall and Maintenance Protection is the setting in a sensor update policy that stops the Falcon sensor from being removed or modified without authorization. When it is enabled, uninstalling the sensor or performing maintenance on it requires a maintenance token, so a user or attacker with local administrator rights cannot simply remove protection from the host. Administrators retrieve the token from the console when legitimate removal is needed, which keeps the uninstall process under central control.
Why the other options are wrong
- A. Installation and Maintenance Protection is not the name of the setting in a sensor update policy.
- B. Sensor Version Control Protection is not a sensor update policy setting; version selection is handled separately.
- D. Update and Management Protection is not the setting that guards against unauthorized uninstallation.
Question 17
When creating your own Fusion SOAR workflow based on an Event trigger, which additional option will refine the trigger?
Show answer and explanation
Correct answer: C. Filter
When a Fusion SOAR workflow is built on an Event trigger, a filter can be applied to the trigger itself so that the workflow only starts for the subset of events that matter, for example events meeting a particular severity or other attribute. Filtering at the trigger narrows which events launch the workflow at all, rather than starting it for every event of that type and then deciding later in the flow what to do.
Why the other options are wrong
- A. Conditions are separate workflow steps placed after the trigger to branch the flow, not an option that refines the trigger.
- B. Trigger Details is not the option used to refine which events start an event-based workflow.
- D. Option is a generic term, not a Fusion SOAR setting for refining an event trigger.
Question 18
You are tasked with creating a group for hosts running Windows 10.
What kind of group should you create to make sure all applicable hosts are included in your environment?
Show answer and explanation
Correct answer: D. Create a dynamic group with the assignment rule criteria for OS Version set to Windows 10
A dynamic host group uses assignment rules to add hosts automatically based on attributes the sensor reports, and it keeps membership current as hosts are added or changed. Setting the rule on OS Version equal to Windows 10 captures exactly the hosts running that operating system, including new ones that come online later. This is the reliable way to ensure every applicable host in the environment is included without manual upkeep.
Why the other options are wrong
- A. Static groups do not use assignment rules, and OS Type Workstation would also include workstations that are not running Windows 10.
- B. A dynamic group is correct, but OS Type Workstation matches all workstation operating systems, not only Windows 10.
- C. Static groups are populated manually and do not use assignment rule criteria, so new Windows 10 hosts would be missed.
Question 19
You are tasked with creating a "Workstations" host group to encompass ALL workstations in your environment.
Which dynamic grouping criteria would best accomplish this task?
Show answer and explanation
Correct answer: D. Type: Workstation
Dynamic host groups automatically add hosts that match defined attributes. The Type attribute is reported by the sensor itself and classifies each host as a workstation, server or domain controller. Using Type: Workstation therefore captures every workstation across all supported platforms without manual tagging, and new workstations join the group automatically as they come online, which makes it the most complete criterion for an all-workstations group.
Why the other options are wrong
- A. Platform: Windows includes Windows servers and domain controllers and excludes Mac and Linux workstations.
- B. Site reflects Active Directory site membership, not whether a host is a workstation.
- C. Grouping tags must be applied manually or at install, so untagged workstations would be missed.
Question 20
What is true about User Accounts created by the Falcon Administrator?
Show answer and explanation
Correct answer: B. All User Accounts must be created with an email address from the list of approved domains
Falcon user accounts are identified by an email address, and a customer's Falcon instance restricts which email domains are permitted for its users. When a Falcon Administrator creates a new user, the email address must belong to one of the domains approved for the customer account, which prevents accounts from being created for addresses outside the organization's control. The administrator then explicitly assigns the roles the user needs, because no role is granted automatically and access follows the principle of least privilege.
Why the other options are wrong
- A. Falcon does not assign a default role such as Falcon Analyst; the administrator chooses roles for each new user explicitly.
- C. User accounts are email addresses, not names built from a domain identifier and a number.
- D. Falcon users are not created from an employee identification number; the login identity is the user's email address.
Question 21
What type of information is provided in the sensor health report?
Show answer and explanation
Correct answer: C. Current operational status
Sensor health reporting focuses on the operational state of deployed sensors. It shows whether sensors are running normally, are in Reduced Functionality Mode, are inactive or have other issues, giving administrators a view of current operational status across the environment. This helps teams quickly find hosts whose protection may be degraded and prioritize remediation.
Why the other options are wrong
- A. User login history is endpoint activity data, not the subject of sensor health reporting.
- B. Local performance metrics such as CPU or memory usage are not what sensor health reporting is designed to show.
- D. Network traffic patterns are telemetry for investigation, not sensor operational health information.
Question 22
When searching for a host network address, which IP notation should be used?
Show answer and explanation
Correct answer: C. 192.168.5.1/24
When searching or filtering hosts by network address in the Falcon console, CIDR notation such as 192.168.5.1/24 lets you match an entire subnet in one entry. This is the efficient way to find all hosts in a given address range, because the prefix length defines exactly which addresses are included. It avoids listing addresses individually and uses a standard notation the search understands.
Why the other options are wrong
- A. Separating addresses with a semicolon is not the supported notation for searching host network addresses.
- B. A comma-separated pair only lists two individual addresses and is not the range notation the search expects.
- D. A dash-style range such as 1-100 is not the supported notation for searching host network addresses.
Question 23
What provides information about inactive sensors within the Falcon console?
Show answer and explanation
Correct answer: C. Sensor Health
Sensor Health gives administrators a view of the condition of sensors across the environment, including those that have become inactive and stopped checking in. It helps identify hosts that need attention, such as machines that have been offline, decommissioned without cleanup or affected by sensor problems. Using it regularly lets a team spot coverage gaps and decide whether a host should be investigated, brought back online or removed from the console, which is why it is the source for information about inactive sensors.
Why the other options are wrong
- A. Sensor Update Policies control which sensor versions are deployed, not the activity status of sensors.
- B. Sensor Downloads provides installers and the Customer ID, not information about inactive sensors.
- D. Sensor Coverage Lookup checks whether given assets have a sensor rather than reporting on inactive sensors.
Question 24
What are the two automated triggers that cause a Fusion SOAR workflow to run?
Show answer and explanation
Correct answer: C. Event and scheduled triggers
A Fusion SOAR workflow starts from a trigger. Event triggers run the workflow automatically when something occurs in Falcon, such as a new detection, incident or audit event. Scheduled triggers run the workflow automatically at a defined time or recurring interval. Workflows can also be started on demand by a user, but that is a manual launch, so event and scheduled triggers are the two automated ways a workflow runs.
Why the other options are wrong
- A. Detections and incidents are categories of events that an event trigger can respond to, not two separate trigger types.
- B. Conditions and actions are steps added after the trigger in a workflow; they do not start the workflow.
- D. Actions are what a workflow performs once it runs; they are not a type of trigger.
Question 25
A Falcon Administrator is unable to initiate a Real-Time Response (RTR) session.
What is the most likely cause?
Show answer and explanation
Correct answer: D. They do not have an RTR role assigned to them
Access to Real Time Response is governed by role-based access control. A user can only open an RTR session if their account has been assigned one of the RTR roles, which also determine which commands they may run. Holding the Falcon Administrator role alone does not grant RTR access, so an administrator without an RTR role will be unable to connect. Assigning the appropriate RTR role in User Management is the usual fix when a session cannot be started on an otherwise online host.
Why the other options are wrong
- A. RTR connects through the Falcon sensor and cloud, so a domain controller does not block the session.
- B. RTR sessions work whether or not a user is logged into the host.
- C. Another analyst being connected does not prevent a new RTR session from being started.
Question 26
When would the No Action option be assigned to a hash in IOC Management?
Show answer and explanation
Correct answer: A. When you want to save the indicator for later action, but do not want to block or allow it at this time
In IOC Management, each custom indicator such as a hash is given an action that tells Falcon how to treat it. No Action lets you store the indicator in the console without enforcing anything: Falcon will not block it, will not allow it and will not raise a detection on it. This is useful when you want to keep a record of an indicator you are still researching, or one you plan to act on later, without affecting hosts in the meantime.
Why the other options are wrong
- B. No Action is a real action choice in IOC Management, alongside actions such as Allow, Block and Detect only.
- C. Adding a hash to the allowlist without detecting it is the Allow action, not No Action.
- D. Blocking a hash and showing it as a detection is the Block action, not No Action.
Question 27
A member of your SECOPS team is building custom scripts for RTR, but they are unable to save or share them in Falcon.
What additional role do they need to be able to accomplish this?
Show answer and explanation
Correct answer: B. Real Time Response - Administrator
Real Time Response roles are tiered. Read-only analysts can run basic investigative commands and active responders can run more commands and use existing scripts, but only the Real Time Response - Administrator role can create, upload, save and share custom scripts and files in the Falcon console. A SECOPS team member who builds scripts but cannot save or share them therefore needs the Real Time Response - Administrator role added to their account.
Why the other options are wrong
- A. Real Time Response - Active Responder can run commands and existing scripts but cannot create, save or share custom scripts.
- C. Saving and sharing custom scripts is limited to the Real Time Response - Administrator role, not every RTR role.
- D. Falcon Scripts Manager is not the Falcon role that governs saving and sharing RTR custom scripts.
Question 28
What is an example of when you will need to refer to your Customer ID + Checksum (CIDC)?
Show answer and explanation
Correct answer: D. When installing a new Falcon Sensor
The Customer ID with checksum (CIDC) identifies the Falcon tenant that a sensor belongs to. It is supplied during installation of a new Falcon sensor so the sensor registers with the correct customer environment in the Falcon cloud. Without the correct value the sensor cannot be associated with the organization's console. The CIDC is shown on the Sensor Downloads page and is commonly passed as an installer parameter in scripted or mass deployments.
Why the other options are wrong
- A. Uninstalling a protected sensor requires a maintenance token, not the Customer ID with checksum.
- B. Hosts are located in Host Management by fields such as hostname, not by the Customer ID.
- C. Host group assignment criteria use host attributes such as hostname, platform or tags, not the Customer ID.
Question 29
Your security team is noticing that certain privacy-sensitive information such as the URL, HTTP Header and POST bodies are missing from HTTP related detections.
What is likely the cause for this?
Show answer and explanation
Correct answer: B. The prevention policy has been configured to redact HTTP detection details
Prevention policies include a setting to redact HTTP detection details. When it is enabled, Falcon removes privacy-sensitive information such as the URL, HTTP headers and POST bodies from HTTP related detections, so analysts still see that the detection occurred but not those details. When a team notices exactly these fields missing from detections, the most likely explanation is that this redaction option is turned on in the prevention policy applied to the affected hosts.
Why the other options are wrong
- A. Prevention and detection slider levels control how aggressively threats are acted on, not whether HTTP details are redacted.
- C. If the firewall blocked the traffic there would be no HTTP detection at all, rather than detections with missing fields.
- D. The detections do exist, so the issue is redacted detail, not a policy that never generated HTTP detections.
Question 30
You are assigning sensor group tags during installation.
What is the maximum allowed length of all tags?
Show answer and explanation
Correct answer: B. 256 characters
Sensor grouping tags can be assigned at installation time and are then used to place hosts into dynamic host groups. The combined length of all tags on a host is limited to 256 characters, and the separating commas count toward that total. Keeping tags short and meaningful leaves room for several tags per host while staying within the limit, which matters when tags drive policy assignment through host groups.
Why the other options are wrong
- A. 237 characters is not the documented limit for the combined length of sensor grouping tags.
- C. 50 characters is far below the actual total length allowed for sensor grouping tags.
- D. 100 characters is lower than the actual total length allowed for sensor grouping tags.
Question 31
What best describes the relationship between Sensor Update policies and Operating Systems?
Show answer and explanation
Correct answer: A. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
Sensor update policies are created for a specific platform. Windows, Mac and Linux sensors have their own builds and release schedules, so each operating system needs its own sensor update policy to control which version is deployed and how updates behave. When an administrator creates a policy, the platform is chosen first, and only hosts of that platform can receive it. Planning update rings therefore means configuring policies separately for each operating system in the environment.
Why the other options are wrong
- B. Sensor update policies are platform specific; a single policy cannot cover Windows, Mac and Linux.
- C. Mac and Linux do not share policies; each platform has its own sensor update policies.
- D. Windows and Mac do not share policies; every platform, not just Linux, requires its own policies.
Question 32
What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?
Show answer and explanation
Correct answer: A. RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.
A Linux sensor enters Reduced Functionality Mode when it cannot load its kernel-level components, typically because the host is running a kernel the sensor does not yet support. In this state the sensor stops processing events and stops generating detections, so the host is effectively unprotected. It still communicates with the CrowdStrike cloud to send basic status information, which lets the Falcon console show the host and flag it as being in RFM so administrators can correct the kernel or sensor version.
Why the other options are wrong
- B. An RFM sensor does not continue streaming log or event data into Falcon; only basic status information is sent.
- C. RFM is not a policy-update problem; event processing and detections stop entirely rather than continuing under existing policies.
- D. An RFM sensor generates no detections, so it cannot send detection information to the console.
Question 33
After attempting to uninstall the Falcon sensor from a Windows endpoint, the process appears stuck. What troubleshooting step should be taken?
Show answer and explanation
Correct answer: D. Check the CrowdStrike Windows Sensor log file for errors
When a Windows sensor uninstall hangs, the first step is to gather evidence rather than take disruptive action. The Windows installer writes a CrowdStrike Windows Sensor log file, typically in the temporary folder of the user running the uninstall, that records each step and any error encountered, such as a missing maintenance token or a failing component. Reviewing this log shows exactly where and why the process stalled, which guides the correct fix and avoids leaving the host in a partially removed state.
Why the other options are wrong
- A. Rebooting immediately interrupts the uninstall without identifying the cause and can leave the sensor partially removed.
- B. The sensor service is protected against tampering, and forcing it to stop is neither supported nor a diagnostic step.
- C. Manually deleting the sensor directory bypasses the supported removal process and can leave the system in an inconsistent state.
Question 34
What information can be found in the Real Time Response (RTR) Audit Log?
Show answer and explanation
Correct answer: C. Session start time, duration, user, hostname, commands used, and retrieved files
The Real Time Response audit log records the details of each RTR session for accountability. It shows when the session started and how long it lasted, which Falcon user ran it, the hostname of the target, the commands that were executed and any files that were retrieved from the host. Administrators use this record to review responder activity and confirm that remote actions on endpoints were appropriate.
Why the other options are wrong
- A. IP address, prevention policy, detections and host group are host management details, not RTR session audit data.
- B. The audit log does not capture full command output or general file activity, and it records more than just end time.
- D. RTR sessions are recorded in a dedicated audit log, so this statement is false.
Question 35
Where can you find a list of hosts that have not communicated with the CrowdStrike Cloud?
Show answer and explanation
Correct answer: A. Inactive Sensors
The Inactive Sensors report lists hosts whose sensors have not communicated with the CrowdStrike cloud for a chosen period. Administrators use it to find machines that may be powered off, disconnected, decommissioned or suffering a sensor problem, along with details such as when each host was last seen. Reviewing this list regularly helps close coverage gaps, because a host that is not checking in is not sending telemetry or receiving updated policies.
Why the other options are wrong
- B. Disabled Sensors is not the report that lists hosts which have stopped communicating with the cloud.
- C. A general sensor report summarizes sensor details but is not the dedicated list of non-communicating hosts.
- D. Custom reports are user-built and are not the standard place that lists hosts without recent cloud contact.
Question 36
Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect should be notified about any incidents with a CrowdScore of 1.0 or higher. What can the Falcon Administrator do to ensure the architect is properly alerted?
Show answer and explanation
Correct answer: C. Add the architect's email address to the manage list for detection and incident emails from the General settings menu
Falcon provides built-in email notifications for detections and incidents that are managed from the General settings area of the console. An administrator adds the recipient's email address to the notification list and sets the thresholds, such as a minimum detection severity of medium and a minimum incident CrowdScore. The architect then receives the required alerts without needing a Falcon login or any custom automation.
Why the other options are wrong
- A. Falcon roles control console permissions; assigning a custom role does not subscribe a user to detection or incident emails.
- B. Emailing on every new detection or incident ignores the medium severity and CrowdScore thresholds the organization specified.
- D. The Detections and Exceptions Manager role grants permissions to manage detections, not automatic email notifications.
Question 37
What happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?
Show answer and explanation
Correct answer: B. Existing detections for the host remain
The Disable Detections action in Host Management stops new detections for the selected host from appearing in the console, which is useful for hosts such as test or analysis machines that would otherwise generate noise. It does not reach back and alter history: detections that were already generated for the host remain in the console and can still be reviewed and managed. Detections can be re-enabled later if the host returns to normal use.
Why the other options are wrong
- A. The action does not delete detection data or hide the host from view.
- C. Disabling detections does not apply a fixed 30-day period; it remains in effect until it is changed.
- D. Existing detections are not removed; the action only affects detections generated after it is applied.
Question 38
To improve the organization's security posture, you are designing a Fusion SOAR workflow to generate an alert when critical vulnerabilities are detected by Falcon.
When creating a new workflow from scratch, what component of the workflow must be configured first?
Show answer and explanation
Correct answer: B. Trigger
Every Fusion SOAR workflow begins with a trigger, the event or schedule that starts the workflow running. When building from scratch, Falcon first asks you to select the trigger, such as a new vulnerability or detection event, because the trigger determines which event data is available to later steps. Only after the trigger is set can you add conditions to filter on details like critical severity and actions like sending an alert or notification.
Why the other options are wrong
- A. Actions are what the workflow does once it runs, and they can only be added after a trigger defines when it runs.
- C. Conditions filter the trigger's event data, so they depend on a trigger already being configured.
- D. The workflow name is entered when saving the workflow, not configured before the trigger.
That was 38 of 153.
The full CrowdStrike CCFA-200b Certified Falcon Administrator pack has all 153 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 76 free as one PDF by email. Get the Half Pack →