CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 171:

  What critical prevention policy setting prevents sensor-related les, folders, and registry objects from being renamed or deleted?

  A. Sensor Modification Protection
  B. System Configuration Protection
  C. Sensor Tampering Protection
  D. Host Modification Protection
  C. Sensor Tampering Protection

  ---

  Explanation

• Question 172:

  How many "Auto" sensor version update options are available for Windows Sensor Update Policies?

  A. 1
  B. 2
  D. 3
  D. 3

  ---

  Explanation

  There are three "Auto" sensor version update options available for Windows Sensor Update Policies: Auto - N-1, Auto - TEST-QA and Auto - Latest. These options allow the administrator to automatically update the sensor version to the

  previous stable version, the latest test version or the latest stable version, respectively.

  [CrowdStrike Falcon User Guide], page 38.

• Question 173:

  Where in the Falcon console can information about supported operating system versions be found?

  A. Configuration module
  B. Intelligence module
  C. Support module
  D. Discover module
  C. Support module

  ---

  Explanation

  Information about supported operating system versions can be found in the Support module in the Falcon console. This module provides access to various support resources, such as documentation, downloads, FAQs, release notes and system status. One of the documents available in this module is the CrowdStrike Sensor Compatibility List, which lists the supported operating system versions for each sensor type and platform. The other options are either incorrect or not related to finding information about supported operating system versions.

  CrowdStrike Falcon User Guide, page 26.

• Question 174:

  Assume the Falcon Sensor was installed on a Virtual Machine template using the installation parameter NO_START=1. Afterward, the Virtual Machine template is rebooted. What is the effect on the Falcon Sensor after reboot?

  A. The Falcon Sensor would start, but only send a heartbeat to the Falcon console
  B. The Falcon Sensor would not automatically start on reboot. It would have to be manually started
  C. The Falcon Sensor would disable BIOS checks at startup
  D. The Falcon Sensor would start at reboot and generate an Agent ID
  D. The Falcon Sensor would start at reboot and generate an Agent ID

  ---

  Explanation

• Question 175:

  What can the Quarantine Manager role do?

  A. Manage and change prevention settings
  B. Manage quarantined files to release and download
  C. Manage detection settings
  D. Manage roles and users
  B. Manage quarantined files to release and download

  ---

  Explanation

  The Quarantine Manager role can manage quarantined files to release and download. This role allows users to view and search quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability.

  [CrowdStrike Falcon User Guide], page 19.

• Question 176:

  You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

  A. Clone the workflow and replace the existing email with your CISO's email
  B. Add a sequential action to send a custom email to your CISO
  C. Add a parallel action to send a custom email to your CISO
  D. Add the CISO's email to the existing action
  C. Add a parallel action to send a custom email to your CISO

  ---

  Explanation

  The best way to update the workflow is to add a parallel action to send a custom email to your CISO. A parallel action allows you to perform multiple actions simultaneously when a workflow is triggered, without affecting the order or outcome of other actions. A sequential action, on the other hand, requires one action to complete before another action can start. By adding a parallel action, you can ensure that both the escalation team and your CISO receive an email notification as soon as possible1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 177:

  You need to export a list of all deletions for a specific Host Name in the last 24 hours. What is the best way to do this?

  A. Go to Host Management in the Host page. Select the host and use the Export Detections button
  B. Utilize the Detection Resolution Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detection Resolution History" section
  C. In the Investigate module, access the Detection Activity page. Use the filters to focus on the appropriate hostname and time, then export the results
  D. Utilize the Detection Activity Dashboard. Use the filters to focus on the appropriate hostname and time, then export the results from the "Detections by Host" section
  C. In the Investigate module, access the Detection Activity page. Use the filters to focus on the appropriate hostname and time, then export the results

  ---

  Explanation

  The best way to export a list of all deletions for a specific Host Name in the last 24 hours is to go to the Investigate module, access the Detection Activity page, use the filters to focus on the appropriate hostname and time, then export the results. This will allow you to download a CSV file that contains information about all the detections that were deleted for that host in that time period. The other options are either incorrect or not related to exporting deletions.

  CrowdStrike Falcon User Guide, page 49.

• Question 178:

  You have a Windows host on your network in Reduced functionality mode (RFM). While the system is in RFM, which of the following is TRUE?

  A. System monitoring will be unavailable
  B. Event reporting will be unavailable
  C. Prevention patterns will not be triggered
  D. Some detection patterns and preventions will not be triggered
  D. Some detection patterns and preventions will not be triggered

  ---

  Explanation

  The option that is true when a Windows host is in Reduced Functionality Mode (RFM) is that some detection patterns and preventions will not be triggered. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Windows sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the %TEMP% directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud. This means that some detection patterns and preventions that rely on telemetry, machine learning, or cloud analysis will not be triggered.

  References: : [Falcon Administrator Learning Path | Infographic | CrowdStrike]

• Question 179:

  Custom IOA rules are defined using which syntax?

  A. Glob
  B. PowerShell
  C. Yara
  D. Regex
  D. Regex

  ---

  Explanation

  Regex guidelines https://falcon.crowdstrike.com/documentation/68/detection- and-prevention-policies#regex

• Question 180:

  Which option best describes the general process Whereinstallation of the Falcon Sensor on MacOS?

  A. Grant the Falcon Package Full Disk Access, install the Falcon package, use falconctl to license the sensor
  B. Install the Falcon package passing it the installation token in the command line
  C. Install the Falcon package, use falconctl to license the sensor, approve the system extension, grant the sensor Full Disk Access
  D. Grant the Falcon Package Full Disk Access, install the Falcon package, load the Falcon Sensor with the command 'falconctl stats'
  A. Grant the Falcon Package Full Disk Access, install the Falcon package, use falconctl to license the sensor

  ---

  Explanation