[Jun 04, 2026] CCFA-200b Dumps Full Questions - Exam Study Guide
CrowdStrike Certified Falcon Administrator Free Certification Exam Material from ExamTorrent with 255 Questions
NEW QUESTION # 142
You are the Falcon Administrator for your organization, and you want to ensure you have accountability for the actions your Falcon users take.
What is the retention period of the audit logs within Falcon?
- A. One year
- B. 90 days
- C. 30 days
- D. 180 days
Answer: B
NEW QUESTION # 143
Which of the following is NOT an available filter on the Hosts Management page?
- A. Group
- B. Hostname
- C. OS Version
- D. Username
Answer: D
Explanation:
Username is not an available filter on the Hosts Management page. The Hosts Management page allows you to view and manage all the hosts in your environment that have Falcon sensors installed. You can filter the hosts by hostname, group, OS version, sensor version, last seen date, health events, detections, and preventions. You can also perform actions such as assigning hosts to groups, updating sensor policies, uninstalling sensors, or isolating hosts.
NEW QUESTION # 144
What best describes the relationship between Sensor Update policies and Operating Systems?
- A. Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems
- B. Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions
- C. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
- D. Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies
Answer: C
Explanation:
The option that describes the relationship between Sensor Update policies and Operating Systems is that a Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux). This option is essentially a repetition of question 141 and its answer.
Sensor Update policies are specific to each operating system type, as different operating systems have different sensor versions, features, and requirements. Therefore, you need to create and assign separate Sensor Update policies for each operating system type in your environment.
NEW QUESTION # 145
Which of the following best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy?
- A. Prevents the sensor from entering Reduced Functionality Mode
- B. Prevents modification of sensor update policy
- C. Prevents automatic updates of the sensor
- D. Prevents unauthorized uninstallation of the sensor
Answer: D
Explanation:
The option that best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy is that it prevents unauthorized uninstallation of the sensor. The Uninstall and Maintenance Protection setting is a feature that adds an extra layer of security to the sensor by requiring a maintenance token to uninstall or update the sensor manually. The maintenance token is a unique code that can be generated by a Falcon Administrator or a Real Time Response - Administrator in the Falcon console. Without a valid maintenance token, the sensor cannot be uninstalled or updated by anyone, including local administrators or malware.
NEW QUESTION # 146
What happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?
- A. Existing detections for the host are removed from the console. The process that triggered them is allow-listed to prevent future alerts. Detections for other alerts are unaffected.
- B. The detections for the host are removed from the console immediately. No new detections will display in the console going forward.
- C. Existing detections for the host remain. No new detections will display in the console going forward.
- D. Detections from the host are paused for 7 days. Existing detections from the host are removed from the console within 24 hours.
Answer: C
NEW QUESTION # 147
How do you find a list of inactive sensors?
- A. A sensor is always considered active until removed by an Administrator
- B. Run the Sensor Aging Report within the Investigate option
- C. Run the Inactive Sensor Report in the Host setup and management option
- D. The Falcon platform does not provide reporting for inactive sensors
Answer: C
Explanation:
The Inactive Sensor Report in the Host setup and management option allows you to view a list of hosts that have not communicated with the Falcon platform for a specified period of time. You can filter the report by sensor version, OS, and last seen date. This report can help you identify hosts that may have connectivity issues or need sensor updates1.
NEW QUESTION # 148
During a sensor installation, what unique identifier is given to each sensor?
- A. Security ID (SID)
- B. Agent ID (AID)
- C. Endpoint ID (EID)
- D. Computer ID (CID)
Answer: B
NEW QUESTION # 149
What command should be run to verify if a Windows sensor is running?
- A. sc query csagent
- B. netstat -f
- C. ps -ef | grep falcon
- D. regedit myfile.reg
Answer: A
Explanation:
The command that should be run to verify if a Windows sensor is running is sc query csagent.
This command will display the status and information of the csagent service, which is the Falcon sensor service. The other commands are either incorrect or not applicable to Windows sensors.
NEW QUESTION # 150
When a host is placed in Network Containment, which of the following is TRUE?
- A. The host machine is unable to send or receive network traffic outside of the local network
- B. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and traffic allowed in the Firewall Policy
- C. The host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy
- D. The host machine is unable to send or receive any network traffic
Answer: C
Explanation:
When a host is placed in Network Containment, the host machine is unable to send or receive network traffic except to/from the Falcon Cloud and any resources allowlisted in the Containment Policy. This allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential services. The other options are either incorrect or not true of Network Containment.
NEW QUESTION # 151
What is the primary concern with Windows sensors going into Reduced Functionality Mode (RFM)?
- A. The sensors do not have full visibility into all events occurring on the host
- B. The sensors are unable to report any of their recorded events
- C. The hosts have been powered off or otherwise cannot communicate with the Falcon cloud
- D. The operating systems on these hosts have crashed
Answer: A
NEW QUESTION # 152
After enabling an IOA rule and its respective rule group, what else must be done for an IOA to be fully functional?
- A. You must individually select which hosts you would like to apply to rule to
- B. The rule group must be assigned to one or more prevention policies
- C. The rule needs to be manually triggered to ensure it works as intended
- D. Nothing else needs to be done; the rule should start working
Answer: B
NEW QUESTION # 153
What is the best way to write an ML exclusion for any executable file at "C:\Program Files\Software\"?
- A. Program Files\Software\.*
- B. Program Files\Software\*.exe
- C. Program Files\Software\**
- D. You cannot. You must list a specific file in an exclusion rule
Answer: B
NEW QUESTION # 154
Which report can assist in determining the appropriate Machine Learning levels to set in a Prevention Policy?
- A. Falcon UI Audit Trail
- B. Sensor Report
- C. Machine Learning Prevention Monitoring
- D. Machine Learning Debug
Answer: C
Explanation:
The Machine Learning Prevention Monitoring report in the Prevention Policy Management option allows you to monitor the impact of machine learning (ML) prevention settings on your environment. You can view the number of ML detections and preventions by severity, policy, and host group. You can also drill down into specific events and hosts to see more details. This report can help you determine the appropriate ML levels to set in a prevention policy based on your risk tolerance and security posture1.
NEW QUESTION # 155
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
- A. 90 Days
- B. 45 Days
- C. 60 Days
- D. 75 Days
Answer: A
Explanation:
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after 90 days. An inactive host is a host that has not communicated with the Falcon platform for more than seven days. An inactive host will be moved from the Host Management page to the Trash page after seven days of inactivity. An inactive host will remain in the Trash page for 90 days before being permanently deleted from the Falcon platform. You can restore an inactive host from the Trash page if it becomes active again within
90 days.
NEW QUESTION # 156
In order to quarantine files on the host, what prevention policy settings must be enabled?
- A. Malware Protection and Custom Execution Blocking must be enabled
- B. Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled
- C. Malware Protection and Windows Anti-Malware Execution Blocking must be enabled
- D. Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled
Answer: B
Explanation:
In order to quarantine files on the host, the administrator must enable the Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" in the prevention policy settings. This will allow Falcon to quarantine malicious files and register them with Windows Security Center. The other options are either incorrect or not sufficient to enable quarantine.
NEW QUESTION # 157
......
CrowdStrike CCFA-200b Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
Dumps Brief Outline Of The CCFA-200b Exam: https://prep4sure.examtorrent.com/CCFA-200b-exam-papers.html
