CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 31:

  If a user wanted to install an older version of the Falcon sensor, how would they find the older installer file?

  A. Older versions of the sensor are not available for download
  B. By emailing CrowdStrike support at [email protected]
  C. By installing the current sensor and clicking the "downgrade" button during the install
  D. By clicking on "Older versions" links under the Host setup and management > Deploy > Sensor downloads
  D. By clicking on "Older versions" links under the Host setup and management > Deploy > Sensor downloads

  ---

  Explanation

  The way to find the older installer file for the Falcon sensor is to click on "Older versions" links under the Host setup and management > Deploy > Sensor downloads. The Sensor downloads page allows you to download the latest version of the Falcon sensor for different operating systems and platforms. However, if you need to install an older version of the sensor, you can click on the "Older versions" links below each sensor download button. This will open a new page where you can select and download any previous version of the sensor1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 32:

  Which is a filter within the Host setup and management > Host management page?

  A. User name
  B. OU
  C. BIOS Version
  D. Locality
  B. OU

  ---

  Explanation

  OU (organizational unit) is a filter within the Host setup and management > Host management page. The Host management page allows you to view and manage all the hosts in your environment that have Falcon sensors installed. You can filter the hosts by hostname, group, OS version, sensor version, last seen date, health events, detections, and preventions. You can also filter by OU, which is a logical grouping of hosts based on their Active Directory domain structure1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 33:

  An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?

  A. 45 Days
  B. 60 Days
  C. 75 Days
  D. 90 Days
  A. 45 Days

  ---

  Explanation

• Question 34:

  Which role is required to manage groups and policies in Falcon?

  A. Falcon Host Analyst
  B. Falcon Host Administrator
  C. Prevention Hashes Manager
  D. Falcon Host Security Lead
  B. Falcon Host Administrator

  ---

  Explanation

  The Falcon Host Administrator role is required to manage groups and policies in Falcon. This role allows users to create, edit and delete groups and policies, as well as assign them to hosts. The other roles do not have this capability.

  [CrowdStrike Falcon User Guide], page 17.

• Question 35:

  How do you assign a Prevention policy to one or more hosts?

  A. Create a new policy and assign it directly to those hosts on the Host Management page
  B. Modify the users roles on the User Management page
  C. Ensure the hosts are in a group and assign that group to a custom Prevention policy
  D. Create a new policy and assign it directly to those hosts on the Prevention policy page
  C. Ensure the hosts are in a group and assign that group to a custom Prevention policy

  ---

  Explanation

  The administrator can assign a Prevention policy to one or more hosts by ensuring the hosts are in a group and assigning that group to a custom Prevention policy. This allows users to apply different prevention settings and options to different groups of hosts based on their needs and preferences. The other options are either incorrect or not applicable to assigning a Prevention policy.

  [CrowdStrike Falcon User Guide], page 34.

• Question 36:

  On a Windows host, what is the best command to determine if the sensor is currently running?

  A. sc query csagent
  B. netstat -a
  C. This cannot be accomplished with a command
  D. ping falcon.crowdstrike.com
  A. sc query csagent

  ---

  Explanation

  On a Windows host, the best command to determine if the sensor is currently running is sc query csagent. This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused. If the service is running, the sensor is also running3.

  References: 3: How to Become a CrowdStrike Certified Falcon Administrator

• Question 37:

  Which of the following can be found in the Falcon UI Audit Trail Report?

  A. Audit records of Falcon instance billing
  B. Audit records of actions taken by both users and API clients
  C. Audit records of actions taken by only APIs
  D. Audit records of actions taken by only users
  B. Audit records of actions taken by both users and API clients

  ---

  Explanation

• Question 38:

  Under which scenario can Sensor Tags be assigned?

  A. While triaging a detection
  B. While managing hosts in the Falcon console
  C. While updating a sensor in the Falcon console
  D. While installing a sensor
  D. While installing a sensor

  ---

  Explanation

  Check in documentation, there are two kind of tags, the Falcon Grouping Tags that can be managed in falcon console or API and the Sensor Grouping Tags that are configured as parameter in cli, that kind of tags can be diferentiated because it appears with the prefix SensorGroupingTags followed with the name of the tag. If you want to modify a sensor tag is necessary change a registry key value and reboot the device or waiting until the sensor is upgraded.

• Question 39:

  Certain services are required to be running to install the Windows Falcon sensor. What may cause the LMHost service to be disabled?

  A. Windows Base Filtering Engine
  B. WinHTTP AutoProxy
  C. TCP/IP NetBIOS Helper
  D. DHCP Client
  C. TCP/IP NetBIOS Helper

  ---

  Explanation

• Question 40:

  How do you find a list of inactive sensors?

  A. The Falcon platform does not provide reporting for inactive sensors
  B. A sensor is always considered active until removed by an Administrator
  C. Run the Inactive Sensor Report in the Host setup and management option
  D. Run the Sensor Aging Report within the Investigate option
  C. Run the Inactive Sensor Report in the Host setup and management option

  ---

  Explanation

  The Inactive Sensor Report in the Host setup and management option allows you to view a list of hosts that have not communicated with the Falcon platform for a specified period of time. You can filter the report by sensor version, OS, and last seen date. This report can help you identify hosts that may have connectivity issues or need sensor updates1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike