CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 1:

  When the Notify End Users policy setting is turned on, which of the following is TRUE?

  A. End users will not be notified as we would not want to notify a malicious actor of a detection. This setting does not exist
  B. End users will be immediately notified via a pop-up that their machine is in-network isolation
  C. End-users receive a pop-up notification when a prevention action occurs
  D. End users will receive a pop-up allowing them to confirm or refuse a pending quarantine
  C. End-users receive a pop-up notification when a prevention action occurs

  ---

  Explanation

  When the Notify End Users policy setting is turned on, end-users receive a pop-up notification when a prevention action occurs. This setting allows you to inform the end-users that the Falcon sensor has blocked or quarantined a malicious item on their system. The notification will also provide the name and path of the item, the reason for the prevention, and a link to contact support if needed1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 2:

  Where in the Falcon platform can you confirm the sensor build version installed on a particular host?

  A. Host Management page by ltering for and selecting the host
  B. Dashboards by viewing the Executive Summary Dashboard
  C. Tool Downloads page by downloading the Sensor Reporting Tool
  D. Sensor Downloads page by ltering for a sensor build and selecting the host
  A. Host Management page by ltering for and selecting the host

  ---

  Explanation

• Question 3:

  Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

  A. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  B. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
  C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  D. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
  C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group

  ---

  Explanation

  The administrator can create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result.

  CrowdStrike Falcon User Guide, page 35.

• Question 4:

  What is the purpose of the "Auto - Latest" setting in a sensor update policy?

  A. This setting overrides any user confirmation/interaction and applies the selected policy
  B. This setting automatically assigns the latest Indicator of Attack (IOA) profiles and Next-Gen Antivirus (NGAV) machine learning to the selected endpoints ensuring the highest level of security
  C. This setting automatically assigns new hosts that come online to this policy
  D. This setting will cause all assigned hosts to be updated to the most current version as soon as it becomes available
  D. This setting will cause all assigned hosts to be updated to the most current version as soon as it becomes available

  ---

  Explanation

• Question 5:

  Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?

  A. Reduce Functionality Audit Report
  B. Sensor Health Report
  C. Sensor Coverage Lookup
  D. Inactive Sensor Report
  B. Sensor Health Report

  ---

  Explanation

• Question 6:

  What can exclusions be applied to?

  A. Individual hosts selected by the administrator
  B. Either all hosts or specified groups
  C. Only the default host group
  D. Only the groups selected by the administrator
  B. Either all hosts or specified groups

  ---

  Explanation

  The option that describes what exclusions can be applied to is that exclusions can be applied to either all hosts or specified groups. An exclusion is a rule that defines what files, folders, processes, IP addresses, or domains should be

  excluded from detection or prevention by the Falcon sensor. You can create and manage exclusions in the Exclusions page in the Falcon console. You can apply exclusions to either all hosts in your environment or to specific host groups that

  you select. You cannot apply exclusions to individual hosts selected by the administrator.

  References: : [Cybersecurity Resources | CrowdStrike]

• Question 7:

  You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?

  A. Contact support and request that they modify the Machine Learning settings to no longer include this detection
  B. Using IOC Management, add the hash of the binary in question and set the action to "Allow"
  C. Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
  D. Using IOC Management, add the hash of the binary in question and set the action to "No Action"
  B. Using IOC Management, add the hash of the binary in question and set the action to "Allow"

  ---

  Explanation

  to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.

• Question 8:

  Which of the following scenarios best describes when you would add IP addresses to the containment policy?

  A. You want to automate the Network Containment process based on the IP address of a host
  B. Your organization has additional IP addresses that need to be able to access the Falcon console
  C. A new group of analysts need to be able to place hosts under Network Containment
  D. Your organization has resources that need to be accessible when hosts are network contained
  D. Your organization has resources that need to be accessible when hosts are network contained

  ---

  Explanation

  The scenario that best describes when you would add IP addresses to the containment policy is that your organization has resources that need to be accessible when hosts are network contained. As explained in the previous question,

  adding IP addresses to the containment policy allows you to create an allowlist of trusted IP addresses that can communicate with your contained hosts. This can be useful when you need to isolate a host from the network due to a potential

  compromise or investigation, but still want to allow it to access certain resources or services that are essential for your organization's operations or security.

  References: Cybersecurity Resources | CrowdStrike

• Question 9:

  When a host is placed in Network Containment, which of the following is TRUE?

  A. The host machine is unable to send or receive network traffic outside of the local network
  B. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and traffic allowed in the Firewall Policy
  C. The host machine is unable to send or receive any network traffic
  D. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy
  D. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy

  ---

  Explanation

  When a host is placed in Network Containment, the host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy. This allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential services. The other options are either incorrect or not true of Network Containment.

  CrowdStrike Falcon User Guide, page 40.

• Question 10:

  Which of the following tools developed by Crowdstrike is intended to help with removal of the CrowdStrike Windows Falcon Sensor?

  A. CrowdStrikeRemovalTool.exe
  B. UninstallTool.exe
  C. CSUninstallTool.exe
  D. FalconUninstall.exe
  C. CSUninstallTool.exe

  ---

  Explanation

  The tool developed by Crowdstrike that is intended to help with removal of the CrowdStrike Windows Falcon Sensor is CSUninstallTool.exe. This tool is a command- line utility that can uninstall the Falcon sensor from a Windows system without requiring user interaction or network connectivity. The tool can also bypass the Uninstall and Maintenance Protection feature if enabled in the Sensor Update Policy.

  References: Cybersecurity Resources | CrowdStrike