CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 41:

  You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

  A. A Sensor Update Policy was misconfigured
  B. A host was offline for more than 24 hours
  C. A patch was pushed overnight to all Windows systems
  D. A host was placed in network containment from a detection
  C. A patch was pushed overnight to all Windows systems

  ---

  Explanation

  The most likely culprit causing multiple Windows hosts to be in Reduced Functionality Mode (RFM) is a patch that was pushed overnight to all Windows systems. RFM occurs when the sensor detects a change in the operating system that requires a reboot to complete. A patch is one of the common causes of such a change. The other options are either incorrect or not related to RFM.

  CrowdStrike Falcon User Guide, page 30.

• Question 42:

  You need to have the ability to monitor suspicious VBA macros. Which Sensor Visibility setting should be turned on within the Prevention policy settings?

  A. Script-based Execution Monitoring
  B. Interpreter-Only
  C. Additional User Mode Data
  D. Engine (Full Visibility)
  A. Script-based Execution Monitoring

  ---

  Explanation

  Turn on the Script-Based Execution Monitoring prevention policy setting to enable the "Falcon sensor to monitor the contents of scripts and shells that are popular mechanisms for executing malicious code on hosts. This setting does not kill or block scripts." Scripting languages: Excel 4.0 macros JScript VBA Macros VBScript The Sensor Visibility setting that should be turned on within the Prevention policy settings to monitor suspicious VBA macros is Script-based Execution Monitoring. Script-based Execution Monitoring is a feature that enables the Falcon sensor to monitor and prevent malicious script execution on Windows systems. The feature uses machine learning and behavioral analysis to detect suspicious scripts or commands executed by various script interpreters, such as PowerShell, WScript, CScript, or Bash. VBA (Visual Basic for Applications) is a scripting language that can be embedded in Microsoft Office documents, such as Word or Excel. VBA macros can be used to automate tasks or perform actions within the documents, but they can also be abused by attackers to deliver malware or execute malicious code. Script-based Execution Monitoring can help detect and prevent such attacks by monitoring the contents of VBA macros for execution of malicious content.

  References: : [Falcon Administrator Learning Path | Infographic | CrowdStrike]

• Question 43:

  What information does the API Audit Trail Report provide?

  A. A list of analyst login activity
  B. A list of specific changes to prevention policy
  C. A list of actions taken via Falcon OAuth2-based APIs
  D. A list of newly added hosts
  C. A list of actions taken via Falcon OAuth2-based APIs

  ---

  Explanation

  The information that the API Audit Trail Report provides is a list of actions taken via Falcon OAuth2-based APIs. The API Audit Trail Report allows you to view and audit the activity and usage of the Falcon APIs by different API clients and users in your organization. You can use this report to monitor who accessed what data, when, and how via the Falcon APIs2.

  References: 2: Cybersecurity Resources | CrowdStrike

• Question 44:

  Why would you assign hosts to a static group instead of a dynamic group?

  A. You do not want the group membership to change automatically
  B. You are managing more than 1000 hosts
  C. You need hosts to be automatically assigned to a group
  D. You want the group to contain hosts from multiple operating systems
  A. You do not want the group membership to change automatically

  ---

  Explanation

  The reason why you would assign hosts to a static group instead of a dynamic group is that you do not want the group membership to change automatically. A Static Group is a group that requires manual assignment or removal of hosts. A Static Group will not update its membership based on any criteria or filters. This way, you can have more control over which hosts belong to the group and prevent any unwanted changes1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 45:

  What is the maximum number of patterns that can be added when creating a new exclusion?

  A. 10
  C. 1
  D. 5
  C. 1

  ---

  Explanation

  The maximum number of patterns that can be added when creating a new exclusion is one. Each exclusion can only have one pattern, which can be a file path, a hash, a command line or a user name. The other options are either incorrect or not related to creating exclusions.

  CrowdStrike Falcon User Guide, page 37.

• Question 46:

  How can a API client secret be viewed after it has been created?

  A. Within the API management page, API client secrets can be accessed within the "edit client" functionality
  B. The API client secret must be reset or a new client created as the secret cannot be viewed after it has been created
  C. The API client secret can be provided by support via direct email request from a Falcon Administrator
  D. Selecting "show secret" within the 3-dot dropdown menu will reveal the secret for the selected api client
  B. The API client secret must be reset or a new client created as the secret cannot be viewed after it has been created

  ---

  Explanation

• Question 47:

  Where can you modify settings to permit certain traffic during a containment period?

  A. Prevention Policy
  B. Host Settings
  C. Containment Policy
  D. Firewall Settings
  C. Containment Policy

  ---

  Explanation

  The administrator can modify settings to permit certain traffic during a containment period by creating or editing a Containment Policy. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment.

  [CrowdStrike Falcon User Guide], page 40.

• Question 48:

  On which page of the Falcon console can one locate the Customer ID (CID)?

  A. Hosts Management
  B. API Clients and Keys
  C. Sensor Dashboard
  D. Sensor Downloads
  D. Sensor Downloads

  ---

  Explanation

• Question 49:

  Which of the following applies to Custom Blocking Prevention Policy settings?

  A. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
  B. Blocklisting applies to hashes, IP addresses, and domains
  C. Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
  D. You can only blocklist hashes via the API
  A. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy

  ---

  Explanation

  Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on "Upload Hashes" in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon?API. https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom- blacklisting/

• Question 50:

  What impact does disabling detections on a host have on an API?

  A. Endpoints with detections disabled will not alert on anything until detections are enabled again
  B. Endpoints cannot have their detections disabled individually
  C. DetectionSummaryEvent stops sending to the Streaming API for that host
  D. Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed
  C. DetectionSummaryEvent stops sending to the Streaming API for that host

  ---

  Explanation

  Disabling detections on a host will stop the DetectionSummaryEvent from sending to the Streaming API for that host. This means that the host will not send any detection events to the Streaming API, which is used to stream data from the Falcon Cloud to external applications or systems. The other options are either incorrect or not related to disabling detections on a host.

  [CrowdStrike Falcon User Guide], page 32.