CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 181:

  What internet domain needs to be added to any required allowlists to allow sensors to communicate with the CrowdStrike Cloud?

  A. falconcloud.net
  B. cloudprotect-cs.net
  C. cloudsink.net
  D. csfalcon.net
  C. cloudsink.net

  ---

  Explanation

• Question 182:

  What is the earliest version of Windows Server that a Sensor is compatible with?

  A. Server 2012
  B. Server 2003
  C. Server 2008 R2 SP1
  D. Server 2008
  C. Server 2008 R2 SP1

  ---

  Explanation

• Question 183:

  You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have

  chosen to use Falcon to do this.

  Which is the best way to accomplish this?

  A. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
  B. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"
  C. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.
  D. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"
  C. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.

  ---

  Explanation

  The best way to ensure that a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers are not allowed to run in your environment is to use IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking. This will allow Falcon to block the execution of these hashes on the hosts using this policy. The other options are either incorrect or not efficient to achieve this goal.

  [CrowdStrike Falcon User Guide], page 44.

• Question 184:

  What must an admin do to reset a user's password?

  A. From User Management, open the account details for the affected user and select "Generate New Password"
  B. From User Management, select "Reset Password" from the three dot menu for the affected user account
  C. From User Management, select "Update Account" and manually create a new password for the affected user account
  D. From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid
  B. From User Management, select "Reset Password" from the three dot menu for the affected user account

  ---

  Explanation

  The administrator can reset a user's password by selecting "Reset Password" from the three dot menu for the affected user account in the User Management page. This will generate a new password and send it to the user's email address. The other options are either incorrect or not available.

  CrowdStrike Falcon User Guide, page 25.

• Question 185:

  Which of the following is NOT an available action for an API Client?

  A. Edit an API Client
  B. Reset an API Client Secret
  C. Retrieve an API Client Secret
  D. Delete an API Client
  C. Retrieve an API Client Secret

  ---

  Explanation

  The option that is not an available action for an API Client is Retrieve an API Client Secret. An API Client is an entity that represents a user or application that can access the Falcon platform programmatically via the Falcon APIs. An API Client has an API Client ID and an API Client Secret, which are used for authenticating and authorizing API requests. You can create and manage API Clients in the API Clients and Keys page in the Falcon console. The available actions for an API Client are Edit an API Client, Reset an API Client Secret, and Delete an API Client. You cannot retrieve an API Client Secret after it has been created, as it is only displayed once during creation for security reasons2.

  References: 2: Cybersecurity Resources | CrowdStrike

• Question 186:

  Which of the following best describes the Default Sensor Update policy?

  A. The Default Sensor Update policy does not have the "Uninstall and maintenance protection" feature
  B. The Default Sensor Update policy is only used for testing sensor updates
  C. The Default Sensor Update policy is a "catch-all" policy
  D. The Default Sensor Update policy is disabled by default
  C. The Default Sensor Update policy is a "catch-all" policy

  ---

  Explanation

  The Default Sensor Update policy is a "catch-all" policy. This means that any host that is not assigned to a specific sensor update policy will inherit the settings from the Default Sensor Update policy. The Default Sensor Update policy is enabled by default and has the "Uninstall and maintenance protection" feature turned on. You can modify the settings of the Default Sensor Update policy, but you cannot delete or disable it2.

  References: 2: Cybersecurity Resources | CrowdStrike