CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 21:

  A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

  A. The host has a user logged into it
  B. The domain controller is preventing the connection
  C. They do not have an RTR role assigned to them
  D. There is another analyst connected into it
  C. They do not have an RTR role assigned to them

  ---

  Explanation

  The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants

  access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles:

  Real Time Response -Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response2.

  References: 2: Cybersecurity Resources | CrowdStrike

• Question 22:

  How do you disable all detections for a host?

  A. Create an exclusion rule and apply it to the machine or group of machines
  B. Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
  C. You cannot disable all detections on individual hosts as it would put them at risk
  D. In Host Management, select the host and then choose the option to Disable Detections
  D. In Host Management, select the host and then choose the option to Disable Detections

  ---

  Explanation

  The administrator can disable all detections for a host by selecting the host and then choosing the option to Disable Detections in the Host Management page. This will prevent the host from sending any detection events to the Falcon Cloud. The other options are either incorrect or not available.

  [CrowdStrike Falcon User Guide], page 32.

• Question 23:

  What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?

  A. Endpoint ID (EID)
  B. Agent ID (AID)
  C. Security ID (SID)
  D. Computer ID (CID)
  B. Agent ID (AID)

  ---

  Explanation

  The name for the unique host identifier in Falcon assigned to each sensor during sensor installation is Agent ID (AID). The AID is a 32-character hexadecimal string that uniquely identifies each sensor and host in the Falcon platform. The other options are either incorrect or not related to the sensor identifier.

  CrowdStrike Falcon User Guide, page 28.

• Question 24:

  How many days will an inactive host remain visible within the Host Management or Trash pages?

  A. 45 days
  B. 15 days
  C. 90 days
  D. 120 days
  A. 45 days

  ---

  Explanation

• Question 25:

  How do user permissions function in Falcon?

  A. Custom user role permission sets are shared with all CrowdStrike customers globally
  B. Each Falcon permission needs to be selected when the user account is created
  C. User permissions grow more restrictive, the more roles assigned to a user the less capabilities they would potentially have
  D. User permissions are cumulative, the more roles assigned to a user the more capabilities they would potentially have
  D. User permissions are cumulative, the more roles assigned to a user the more capabilities they would potentially have

  ---

  Explanation

• Question 26:

  When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

  A. Create a Dynamic Group with Type=Workstation Assignment
  B. Create a Dynamic Group and Import All Workstations
  C. Create a Static Group and Import all Workstations
  D. Create a Static Group with Type=Workstation Assignment
  A. Create a Dynamic Group with Type=Workstation Assignment

  ---

  Explanation

  The best method to ensure all workstation hosts are added to the group is to create a Dynamic Group with Type=Workstation Assignment. A Dynamic Group is a group that automatically updates its membership based on certain criteria or filters. A Type=Workstation Assignment filter will match all hosts that have the workstation type assigned in their Active Directory domain. This way, any new or existing workstation hosts will be added to the group without manual intervention1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 27:

  Where should you look to find the history of the successes and failures for any Falcon Fusion workflows?

  A. Workflow Execution log
  B. Falcon Ul Audit Trail
  C. Workflow Audit log
  D. Custom Alert History
  A. Workflow Execution log

  ---

  Explanation

  The place where you can find the history of the successes and failures for any Falcon Fusion workflows is the Workflow Execution log. The Workflow Execution log in the Workflow Management option allows you to view the status and results of workflow executions triggered by detection events. You can filter the log by workflow name, status, start and end time, and detection ID. You can also view the details of each execution, including the actions performed, the output received, and any errors encountered. This log can help you troubleshoot potential failures or issues with your workflows1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 28:

  Which of the following would give you information about inactive sensors within the Falcon console?

  A. Sensor Coverage Lookup
  B. Sensor Health
  C. Sensor Update Policies
  D. Sensor Downloads
  B. Sensor Health

  ---

  Explanation

• Question 29:

  What is the function of a single asterisk (*) in an ML exclusion pattern?

  A. The single asterisk will match any number of characters, including none. It does include separator characters, such as \ or /, which separate portions of a file path
  B. The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path
  C. The single asterisk is the insertion point for the variable list that follows the path
  D. The single asterisk is only used to start an expression, and it represents the drive letter
  B. The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/machine-learning

  The asterisk is a wildcard character that can be used in exclusion patterns to match any number of characters. However, it does not match separator characters, such as \ or /, which are used to separate portions of a file path. For example,

  the pattern C:\Windows\*\*.exe will match any executable file in any subfolder of the Windows folder, but not in the Windows folder itself.

  Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 30:

  Which of the following prevention policy settings monitors contents of scripts and shells for execution of malicious content on compatible operating systems?

  A. Script-based Execution Monitoring
  B. FileSystem Visibility
  C. Engine (Full Visibility)
  D. Suspicious Scripts and Commands
  A. Script-based Execution Monitoring

  ---

  Explanation

  The prevention policy setting that monitors contents of scripts and shells for execution of malicious content on compatible operating systems is Script-based Execution Monitoring. Script-based Execution Monitoring is a feature that enables the Falcon sensor to monitor and prevent malicious script execution on Windows systems. The feature uses machine learning and behavioral analysis to detect suspicious scripts or commands executed by various script interpreters, such as PowerShell, WScript, CScript, or Bash. You can enable or disable Script-based Execution Monitoring in the Prevention Policy for Windows hosts1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike