CrowdStrike CCFA-200b Certified Falcon Administrator Exam Practice Questions
US$39
Every question with the correct answer and why the other options are wrong.
Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.
Three of the 153 questions in this pack
Question 1
Where would you apply a configuration to allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained?
Show answer and explanation
Correct answer: B. Containment Policy
Network containment cuts a host off from everything except the Falcon cloud, which can also stop analysts from reaching remediation tools, DNS servers or other required infrastructure. To keep specific communication paths open during containment, an administrator lists the permitted IP addresses or CIDR ranges in a Containment Policy and assigns that policy to host groups. Contained hosts covered by the policy can then still talk to those addresses while all other traffic remains blocked, so the investigation and recovery work can continue without exposing the host to the wider network.
Why the other options are wrong
- A. IP Allowlist Management restricts which IP addresses may reach the Falcon console and APIs; it does not govern traffic from contained hosts.
- C. Response policies control Real Time Response capabilities such as commands and scripts, not the addresses a contained host can reach.
- D. A maintenance token protects the sensor against unauthorized uninstall or modification and has nothing to do with containment traffic.
Question 2
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
Show answer and explanation
Correct answer: D. 45 Days
Falcon automatically cleans up hosts that stop checking in so that the host inventory reflects the real environment. When a host has not contacted the Falcon cloud for 45 days, it is removed from the Host Management and Trash pages without any administrator action. This keeps decommissioned, reimaged or long-offline machines from cluttering host lists and reports. If the same machine later reconnects, its sensor checks in again and the host reappears, so the automatic removal does not require any reinstallation.
Why the other options are wrong
- A. 75 days is longer than the inactivity period after which Falcon automatically removes a host from these pages.
- B. 60 days does not match the automatic removal window, which is reached earlier.
- C. 90 days is double the actual inactivity period used for automatic removal.
Question 3
What prevention policy setting prevents sensor-related files, folders, and registry objects from being renamed or deleted?
Show answer and explanation
Correct answer: C. Sensor Tampering Protection
Sensor Tampering Protection is a prevention policy setting that defends the Falcon sensor itself. When it is enabled, attempts to rename, delete or otherwise alter the sensor's files, folders and registry objects are blocked, and attempts to stop or unload the sensor are prevented. This matters because attackers frequently try to disable endpoint security before carrying out the rest of an intrusion. Keeping the setting on ensures the sensor continues to collect telemetry and enforce prevention even against users or processes with elevated privileges.
Why the other options are wrong
- A. Host Modification Protection is not a Falcon prevention policy setting for protecting sensor files and registry objects.
- B. System Configuration Protection is not the setting that blocks renaming or deleting sensor-related objects.
- D. Sensor Modification Protection is not the name of the Falcon prevention policy setting that guards sensor components.
How much of the CrowdStrike CCFA-200b Certified Falcon Administrator bank is free?
153 questions in the bankEach step includes the one before, so buying only adds new questions.
- You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
- 3825% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
- 76the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
- 153100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
What’s in the CrowdStrike CCFA-200b Certified Falcon Administrator pack
- 153 real questions for the current version of the exam, on deploying and administering the Falcon platform
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Instant delivery by email the moment you check out
- Free monthly updates for as long as the exam is live
- Pass or your money back
This pack is US$39, paid once, and refunded if you fail.
What makes the CCFA hard
CrowdStrike expects candidates to have at least 6 months of hands-on experience running Falcon in production, and the questions read that way. You are given a situation and asked what an administrator should do: a host is in Reduced Functionality Mode, a sensor will not install, a contained host still needs to reach a trusted IP address, or a workflow has to respond to a trigger. Several options sound reasonable and one matches how the console actually works.
The exam has 60 questions in 90 minutes, so there is little time to puzzle over unfamiliar menus. Knowing where each setting lives, and which role or policy it belongs to, is what separates a pass from a retake.
This pack has 153 real questions covering user management, roles and API keys, sensor deployment and troubleshooting, host management, host groups, prevention, sensor update and containment policies, custom IOA rules and IOC settings, sensor reports and audit logs, and workflows, so the question style is familiar before exam day.
About the exam
The CrowdStrike Certified Falcon Administrator (CCFA) exam has 60 multiple-choice questions, each with one correct answer, and gives you 90 minutes. You can take it online with Pearson OnVUE or at a Pearson test center. Vouchers cost US$250 and are bought through your CrowdStrike account executive or through Pearson. CrowdStrike recommends 6 or more months of Falcon production experience.
Questions before you buy
How quickly do I receive it?
Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.