CrowdStrike CCFA-200 Online Practice Questions and Exam Preparation

CrowdStrike CCFA-200 Online Questions & Answers

• Question 61:

  In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?

  A. Sensor version set to N-1 and Bulk maintenance mode is turned on
  B. Sensor version fixed and Uninstall and maintenance protection turned on
  C. Sensor version updates off and Uninstall and maintenance protection turned off
  D. Sensor version set to N-2 and Bulk maintenance mode is turned on
  B. Sensor version fixed and Uninstall and maintenance protection turned on

  ---

  Explanation

  In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, the administrator should set the Sensor version to fixed and turn on the Uninstall and maintenance protection setting in the Sensor Update Policy. This will allow the administrator to specify which sensor version will be used by the hosts using this policy, and also require a maintenance token to uninstall or upgrade the sensor. The other options are either incorrect or not sufficient to meet this criteria.

  CrowdStrike Falcon User Guide, page 38.

• Question 62:

  An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

  A. File exclusions are not aligned to groups or hosts
  B. There is a limit of three groups of hosts applied to any exclusion
  C. There is no limit and exclusions can be applied to any or all groups
  D. Each exclusion can be aligned to only one group of hosts
  C. There is no limit and exclusions can be applied to any or all groups

  ---

  Explanation

  An exclusion is a rule that tells the Falcon platform to ignore certain files, folders, processes, or registry keys when performing prevention or detection actions. An administrator can create an exclusion and apply it to one or more groups of hosts, or to all hosts in the organization. For example, an administrator can create an exclusion for a legitimate application that is causing false positives and apply it to the group of hosts that are running that application.

  Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 63:

  What three things does a workflow condition consist of?

  A. A parameter, an operator, and a value
  B. A beginning, a middle, and an end
  C. Triggers, actions, and alerts
  D. Notifications, alerts, and API's
  A. A parameter, an operator, and a value

  ---

  Explanation

• Question 64:

  When performing targeted filtering for a host on the Host Management Page, which filter bar attribute is NOT case-sensitive?

  A. Username
  B. Model
  C. Domain
  D. Hostname
  D. Hostname

  ---

  Explanation

  When performing targeted filtering for a host on the Host Management Page, the filter bar attribute that is not case-sensitive is Hostname. The Hostname attribute allows you to filter hosts by their computer name or DNS name. The Hostname filter is not case- sensitive, meaning that it will match hosts regardless of the capitalization of their names. For example, filtering by hostname=DESKTOP-1234 will match hosts with names such as DESKTOP-1234, desktop-1234, or Desktop12342.

  References: 2: Cybersecurity Resources | CrowdStrike

• Question 65:

  Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?

  A. Sensor Report
  B. Machine Learning Prevention Monitoring
  C. Falcon UI Audit Trail
  D. Machine Learning Debug
  B. Machine Learning Prevention Monitoring

  ---

  Explanation

  The Machine Learning Prevention Monitoring report in the Prevention Policy Management option allows you to monitor the impact of machine learning (ML) prevention settings on your environment. You can view the number of ML detections and preventions by severity, policy, and host group. You can also drill down into specific events and hosts to see more details. This report can help you determine the appropriate ML levels to set in a prevention policy based on your risk tolerance and security posture1.

  References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

• Question 66:

  What is the goal of a Network Containment Policy?

  A. Increase the aggressiveness of the assigned prevention policy
  B. Limit the impact of a compromised host on the network
  C. Gain more visibility into network activities
  D. Partition a network for privacy
  B. Limit the impact of a compromised host on the network

  ---

  Explanation

  The goal of a Network Containment Policy is to limit the impact of a compromised host on the network. This policy allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential

  services. This can help prevent further damage or data exfiltration from a compromised host. The other options are either incorrect or not related to the policy.

  [CrowdStrike Falcon User Guide], page 40.

• Question 67:

  What best describes the relationship between Sensor Update policies and Operating Systems?

  A. Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions
  B. Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems
  C. Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies
  D. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
  D. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)

  ---

  Explanation

• Question 68:

  When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

  A. Custom IOA Rule Groups
  B. Custom IOC Groups
  C. Enterprise Groups
  D. Operating System Groups
  A. Custom IOA Rule Groups

  ---

  Explanation

  Prevention Policies are created based on the OS (Windows, MAC and Linux policies). Once a prevention policy is created, three options appear on top: Settings, Assigned Host Groups and Assigned Custom IOAS (tested on Crowdstrike). Therefore, Host Groups and Custom IOAS are the two different types of groups a prevention policy can be aligned to.

• Question 69:

  When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?

  A. Maintenance token
  B. Customer ID (CID)
  C. Bulk update key
  D. Agent ID (AID)
  A. Maintenance token

  ---

  Explanation

  When uninstalling a sensor, a maintenance token is required if the `Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies. This setting prevents unauthorized or accidental uninstallation of sensors by requiring a token that can be generated from the Falcon console. The other options are either incorrect or not related to uninstalling a sensor.

  CrowdStrike Falcon User Guide, page 29.

• Question 70:

  Which of the following steps are required to delete a sensor update policy?

  A. Remove the policy from all assigned host groups, disable the policy, then click Delete from the policy's settings
  B. From the policy's settings, disable all toggles first, then click Delete
  C. Remove the policy from all assigned host groups, then click Delete from the policy's settings
  D. From the policy's settings, disable the policy, then click Delete
  D. From the policy's settings, disable the policy, then click Delete

  ---

  Explanation

  Deleting a sensor update policy is a two-step process: disable the policy, then delete it. Go to Policy Detail Disable the policy you want to delete After disabling, click Delete