CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 51:

  If you are not able to update your Falcon sensors on a regular basis, what is the maximum recommended aging period before updating your sensors?

  A. 7 days
  B. 60 days
  C. 90 days
  D. There is no maximum aging period
  B. 60 days

  ---

  Explanation

• Question 52:

  On which page of the Falcon console would you create sensor groups?

  A. User management
  B. Sensor update policies
  C. Host management
  D. Host groups
  D. Host groups

  ---

  Explanation

  The only place where create host groups is in " Host and setup management > host Groups> Create a group" In Sensor Update policies you can only asign a group of host to the policy not creating a group of hosts.

• Question 53:

  The Falcon Administrator has created a new prevention policy to apply to the "Servers" group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?

  A. The new prevention policy should be enabled first
  B. The "Servers" group already has a policy applied to it
  C. The "Servers" group must be disabled first
  D. Host type was not defined correctly within the prevention policy
  B. The "Servers" group already has a policy applied to it

  ---

  Explanation

  The most likely issue for not being able to apply a new prevention policy to the "Servers" group is that the "Servers" group already has a policy applied to it. A prevention policy is a policy that defines the prevention capabilities and settings for the Falcon sensor on a host. You can create and assign custom prevention policies to different hosts or groups in your environment. However, you can only assign one prevention policy per host or group at a time. If a host or group already has a prevention policy applied to it, you cannot apply another prevention policy to it unless you remove or replace the existing one2.

  References: 2: Cybersecurity Resources | CrowdStrike

• Question 54:

  An analyst is asked to retrieve an API client secret from a previously generated key. How can they achieve this?

  A. The API client secret can be viewed from the Edit API client pop-up box
  B. Enable the Client Secret column to reveal the API client secret
  C. Re-create the API client using the exact name to see the API client secret
  D. The API client secret cannot be retrieved after it has been created
  D. The API client secret cannot be retrieved after it has been created

  ---

  Explanation

  The API client secret cannot be retrieved after it has been created. The secret is only displayed once when the API client is created, and it cannot be viewed or edited later. Therefore, it is important to save the secret securely and use it along with the client ID to authenticate the API client. The other options are either incorrect or not possible.

  CrowdStrike Falcon User Guide, page 54.

• Question 55:

  Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

  A. There may be special considerations for each OS
  B. To assist with testing and tracking sensor rollouts
  C. The network protocols are different for each host OS
  D. It is an auditing requirement
  A. There may be special considerations for each OS

  ---

  Explanation

  https://www.crowdstrike.com/blog/tech-center/how-to-manage-policies-in- falcon/

• Question 56:

  Which of the following pages provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System?

  A. Support and resources
  B. Activity Overview
  C. Hosts Overview
  D. Sensor Health
  D. Sensor Health

  ---

  Explanation

  The page that provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System is Sensor Health. The Sensor Health page allows you to view and monitor the health and status of all sensors in your environment. You can use this page to identify any sensors that have issues or errors, such as RFM, which is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. You can filter the sensors by operating system, sensor version, last seen date, health events, detections, and preventions.

  References: How to Become a CrowdStrike Certified Falcon Administrator

• Question 57:

  What are the three configurable parts of a machine learning exclusion?

  A. File paths, names, and extensions
  B. Drive letters, directories, and patterns
  C. Parameters, operators, and values
  D. Triggers, actions and alerts
  A. File paths, names, and extensions

  ---

  Explanation

• Question 58:

  What command should be run to verify if a Windows sensor is running?

  A. regedit myfile.reg
  B. sc query csagent
  C. netstat -f
  D. ps -ef | grep falcon
  B. sc query csagent

  ---

  Explanation

  The command that should be run to verify if a Windows sensor is running is sc query csagent. This command will display the status and information of the csagent service, which is the Falcon sensor service. The other commands are either incorrect or not applicable to Windows sensors.

  [CrowdStrike Falcon User Guide], page 29.

• Question 59:

  When a host belongs to more than one host group, how is sensor update precedence determined?

  A. Groups have no impact on sensor update policies
  B. Sensors of hosts that belong to more than one group must be manually updated
  C. The highest precedence policy from the most important group is applied to the host
  D. All of the host's groups are examined in aggregate and the policy with highest precedence is applied to the host
  D. All of the host's groups are examined in aggregate and the policy with highest precedence is applied to the host

  ---

  Explanation

  The option that describes how sensor update precedence is determined when a host belongs to more than one host group is that all of the host's groups are examined in aggregate and the policy with highest precedence is applied to the host. A Sensor Update policy is a policy that controls how and when the Falcon sensor is updated on a host. You can create and assign custom Sensor Update policies to different hosts or groups in your environment. Each Sensor Update policy has a precedence value, which determines its priority over other policies. The higher the precedence value, the higher the priority. If a host belongs to more than one host group, each with a different Sensor Update policy assigned, then all of the host's groups are examined in aggregate and the policy with highest precedence among them is applied to the host.

  References: : [Falcon Administrator Learning Path | Infographic | CrowdStrike]

• Question 60:

  Which role will allow someone to manage quarantine files?

  A. Falcon Security Lead
  B. Detections Exceptions Manager
  C. Falcon Analyst ?Read Only
  D. Endpoint Manager
  A. Falcon Security Lead

  ---

  Explanation

  The role that will allow someone to manage quarantine files is Falcon Security Lead. This role allows users to view and manage quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability.

  CrowdStrike Falcon User Guide, page 19.