CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 11:

  Under the "Next-Gen Antivirus: Cloud Machine Learning" setting there are two categories, one of them is "Cloud Anti-Malware" and the other is:

  A. Adware and PUP
  B. Advanced Machine Learning
  C. Sensor Anti-Malware
  D. Execution Blocking
  A. Adware and PUP

  ---

  Explanation

  With EDR license, if you go to "Audit logs > Machine-learning prevention monitoring", three options appear: Cloud Anti-malware, Sensor Anti-malware and AdwareandPUP. Therefore, answer is A.

• Question 12:

  What type of information is found in the Linux Sensors Dashboard?

  A. Hosts by Kernel Version, Shells spawned by Root, Wget/Curl Usage
  B. Hidden File execution, Execution of file from the trash, Versions Running with Computer Names
  C. Versions running, Directory Made Invisible to Spotlight, Logging/Auditing Referenced, Viewed, or Modified
  D. Private Information Accessed, Archiving Tools ?Exfil, Files Made Executable
  A. Hosts by Kernel Version, Shells spawned by Root, Wget/Curl Usage

  ---

  Explanation

  The type of information that is found in the Linux Sensors Dashboard is Hosts by Kernel Version, Shells spawned by Root, Wget/Curl Usage. The Linux Sensors Dashboard is a dashboard that provides an overview of the Linux hosts in your environment that have Falcon sensors installed. You can use this dashboard to monitor the health and activity of your Linux hosts, such as their kernel versions, root shell usage, network communication, detections, and preventions.

  References: How to Become a CrowdStrike Certified Falcon Administrator

• Question 13:

  You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions

  during the testing phase.

  What settings do you choose?

  A. Detection slider: Extra Aggressive Prevention slider: Cautious
  B. Detection slider: Moderate Prevention slider: Disabled
  C. Detection slider: Cautious Prevention slider: Cautious
  D. Detection slider: Disabled Prevention slider: Disabled
  C. Detection slider: Cautious Prevention slider: Cautious

  ---

  Explanation

  The best settings to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase are Cautious for both Detection and Prevention sliders. This setting will enable the sensor to detect and prevent only high-confidence malicious events, while allowing low-confidence events to run without interference. This setting will also generate less noise and false positives than higher settings, such as Moderate or Extra Aggressive1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 14:

  When a user initiates a sensor installs, where can the logs be found?

  A. %SYSTEMROOT%\Logs
  B. %SYSTEMROOT%\Temp
  C. %LOCALAPPDATA%\Logs
  D. % LOCALAPP D ATA%\Tem p
  B. %SYSTEMROOT%\Temp

  ---

  Explanation

  When a user initiates a sensor install, the logs can be found in %SYSTEMROOT%\Temp. This folder contains temporary files and folders created by the system or applications, including the sensor installation logs. The sensor installation logs have names that start with CSFalconContainer and end with .log, such as CSFalconContainer-2023-08-31_11-23-21.log. These logs can help you troubleshoot any issues or errors that may occur during the sensor installation process3.

  References: 3: How to Become a CrowdStrike Certified Falcon Administrator

• Question 15:

  Where can you find your company's Customer ID (CID)?

  A. The CID is a secret key used for Falcon communication and is never shared with the customer
  B. The CID is only available by calling support
  C. The CID is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum
  D. The CID is located at Hosts > Host Management
  C. The CID is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum

  ---

  Explanation

  The CID (Customer ID) is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum. The CID is a unique identifier for your organization that is required for authenticating your sensor installation and communication with the Falcon cloud. The checksum is a value that verifies the integrity of the sensor download file. You can find your CID and checksum at the top of the Sensor Downloads page1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 16:

  You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

  A. Specific sensor version number
  B. Auto - TEST-QA
  C. Sensor version updates off
  D. Auto - N-1
  A. Specific sensor version number

  ---

  Explanation

  The administrator can choose a specific sensor version number in the Sensor Update policy to manually control when the sensor version is upgraded or downgraded. This will allow the Falcon Cloud to push out sensor version changes, but

  only when the administrator changes the version number in the policy. The other options will either automate the sensor version updates or turn them off completely.

  [CrowdStrike Falcon User Guide], page 38.

• Question 17:

  Which of the following is a valid step when troubleshooting sensor installation failure?

  A. Confirm all required services are running on the system
  B. Enable the Windows firewall
  C. Disable SSL and TLS on the host
  D. Delete any available application crash log files
  A. Confirm all required services are running on the system

  ---

  Explanation

  A valid step when troubleshooting sensor installation failure is to confirm all required services are running on the system. This can help identify if there are any issues with the sensor service, the Windows Management Instrumentation service, or the Windows Remote Management service, which are required for the sensor to function properly. The other options are either incorrect or not helpful for troubleshooting sensor installation failure.

  CrowdStrike Falcon User Guide, page 29.

• Question 18:

  Which of the following policies allowlist network traffic even while a host is Network Contained?

  A. Firewall Policy
  B. IP Allowlist Policy
  C. Response Policy
  D. Containment Policy
  D. Containment Policy

  ---

  Explanation

• Question 19:

  What kind of hosts can be contained in Falcon?

  A. Only Windows hosts running the Falcon sensor
  B. Only Windows and Linux hosts running the Falcon sensor
  C. Only Windows and MacOS hosts running the Falcon sensor
  D. Any host running the Falcon sensor
  D. Any host running the Falcon sensor

  ---

  Explanation

• Question 20:

  Which option allows you to exclude behavioral detections from the detections page?

  A. Machine Learning Exclusion
  B. IOA Exclusion
  C. IOC Exclusion
  D. Sensor Visibility Exclusion
  B. IOA Exclusion

  ---

  Explanation

  IOA Exclusion says - Stop all behavioral detections and preventions for an IOA that's based on a CrowdStrike-generated detection. Source: https://falcon.crowdstrike.com/documentation/68/detection-and-prevention- policies#exclusions