New 2023 Realistic Free CrowdStrike CCFA-200 Exam Dump Questions and Answer
CCFA-200 Practice Test Engine: Try These 152 Exam Questions
NEW QUESTION # 32
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.
- A. the logon type (e.g. interactive, service)
- B. the last time the user's password was set
- C. all hosts the user logged into
- D. the account type for the user (e.g. Domain Administrator, Local User)
Answer: B
NEW QUESTION # 33
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?
- A. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
- B. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
- C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
- D. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Answer: C
Explanation:
Explanation
The administrator can create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result. Reference: CrowdStrike Falcon User Guide, page 35.
NEW QUESTION # 34
What would be the most appropriate action to take if you wanted to prevent a folder from being uploaded to the cloud without disabling uploads globally?
- A. An IOA exclusion
- B. A Custom IOC entry
- C. A Machine Learning exclusion
- D. A Sensor Visibility exclusion
Answer: B
Explanation:
Explanation
The most appropriate action to take if you wanted to prevent a folder from being uploaded to the cloud without disabling uploads globally is to create a Custom IOC entry. A Custom IOC (indicator of compromise) entry allows you to define custom rules for detecting or preventing malicious activity based on file hashes, file paths, IP addresses, or domains. You can use regex (regular expression) syntax to create a Custom IOC entry that matches the folder path that you want to block from being uploaded to the cloud1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 35
You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?
- A. A Sensor Update Policy was misconfigured
- B. A host was offline for more than 24 hours
- C. A patch was pushed overnight to all Windows systems
- D. A host was placed in network containment from a detection
Answer: C
Explanation:
Explanation
The most likely culprit causing multiple Windows hosts to be in Reduced Functionality Mode (RFM) is a patch that was pushed overnight to all Windows systems. RFM occurs when the sensor detects a change in the operating system that requires a reboot to complete. A patch is one of the common causes of such a change.
The other options are either incorrect or not related to RFM. Reference: CrowdStrike Falcon User Guide, page
30.
NEW QUESTION # 36
Where should you look to find the history of the successes and failures for any Falcon Fusion workflows?
- A. Workflow Audit log
- B. Falcon Ul Audit Trail
- C. Custom Alert History
- D. Workflow Execution log
Answer: D
Explanation:
Explanation
The place where you can find the history of the successes and failures for any Falcon Fusion workflows is the Workflow Execution log. The Workflow Execution log in the Workflow Management option allows you to view the status and results of workflow executions triggered by detection events. You can filter the log by workflow name, status, start and end time, and detection ID. You can also view the details of each execution, including the actions performed, the output received, and any errors encountered. This log can help you troubleshoot potential failures or issues with your workflows1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 37
Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?
- A. Real Time Responder - Active Responder
- B. Real Time Responder - Read Only Analyst
- C. Real Time Responder - Script Developer
- D. Real Time Responder - Administrator
Answer: C
NEW QUESTION # 38
Which of the following pages provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System?
- A. Sensor Health
- B. Support and resources
- C. Activity Overview
- D. Hosts Overview
Answer: A
Explanation:
Explanation
The page that provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System is Sensor Health. The Sensor Health page allows you to view and monitor the health and status of all sensors in your environment. You can use this page to identify any sensors that have issues or errors, such as RFM, which is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. You can filter the sensors by operating system, sensor version, last seen date, health events, detections, and preventions3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 39
What three things does a workflow condition consist of?
- A. Triggers, actions, and alerts
- B. A beginning, a middle, and an end
- C. Notifications, alerts, and API's
- D. A parameter, an operator, and a value
Answer: D
Explanation:
Explanation
A workflow condition consists of a parameter, an operator, and a value. A workflow condition is a rule that defines when a workflow should be triggered based on certain criteria or filters. A parameter is a variable or attribute that can be used to filter or match detection events, such as severity, tactic, or host group. An operator is a symbol or word that specifies how to compare or evaluate the parameter and the value, such as equals, contains, or greater than. A value is a constant or expression that provides the expected or desired result for the parameter, such as high, credential dumping, or default group1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 40
How many "Auto" sensor version update options are available for Windows Sensor Update Policies?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Explanation
There are three "Auto" sensor version update options available for Windows Sensor Update Policies: Auto - N-1, Auto - TEST-QA and Auto - Latest. These options allow the administrator to automatically update the sensor version to the previous stable version, the latest test version or the latest stable version, respectively.
Reference: [CrowdStrike Falcon User Guide], page 38.
NEW QUESTION # 41
Which of the following is TRUE of the Logon Activities Report?
- A. It gives a detailed list of all logon activity for users
- B. The report can be filtered by computer name
- C. Shows a graphical view of user logon activity and the hosts the user connected to
- D. It only gives a summary of the last logon activity for users
Answer: D
Explanation:
Explanation
The Logon Activities Report shows a graphical view of user logon activity and the hosts the user connected to, but it only gives a summary of the last logon activity for users. It does not give a detailed list of all logon activity for users, nor can it be filtered by computer name. The other options are either incorrect or not true of the report. Reference: CrowdStrike Falcon User Guide, page 50.
NEW QUESTION # 42
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?
- A. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
- B. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
- C. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
- D. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Answer: C
NEW QUESTION # 43
You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?
- A. Auto - TEST-QA
- B. Specific sensor version number
- C. Sensor version updates off
- D. Auto - N-1
Answer: B
Explanation:
Explanation
The administrator can choose a specific sensor version number in the Sensor Update policy to manually control when the sensor version is upgraded or downgraded. This will allow the Falcon Cloud to push out sensor version changes, but only when the administrator changes the version number in the policy. The other options will either automate the sensor version updates or turn them off completely. Reference: [CrowdStrike Falcon User Guide], page 38.
NEW QUESTION # 44
When performing targeted filtering for a host on the Host Management Page, which filter bar attribute is NOT case-sensitive?
- A. Hostname
- B. Username
- C. Domain
- D. Model
Answer: A
Explanation:
Explanation
When performing targeted filtering for a host on the Host Management Page, the filter bar attribute that is not case-sensitive is Hostname. The Hostname attribute allows you to filter hosts by their computer name or DNS name. The Hostname filter is not case-sensitive, meaning that it will match hosts regardless of the capitalization of their names. For example, filtering by hostname=DESKTOP-1234 will match hosts with names such as DESKTOP-1234, desktop-1234, or Desktop-12342.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 45
Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?
- A. Inactive Sensor Report
- B. Reduce Functionality Audit Report
- C. Sensor Health Report
- D. Sensor Coverage Lookup
Answer: D
Explanation:
Explanation
The report that lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported is Sensor Coverage Lookup. The Sensor Coverage Lookup report allows you to view and compare the sensor versions and coverage status for each operating system type in your environment. You can use this report to identify any sensors that are in RFM or are approaching end-of-life (EOL) support. You can also view the release date and EOL date for each sensor version3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 46
Where can you find your company's Customer ID (CID)?
- A. The CID is located at Hosts > Host Management
- B. The CID is a secret key used for Falcon communication and is never shared with the customer
- C. The CID is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum
- D. The CID is only available by calling support
Answer: C
Explanation:
Explanation
The CID (Customer ID) is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum. The CID is a unique identifier for your organization that is required for authenticating your sensor installation and communication with the Falcon cloud. The checksum is a value that verifies the integrity of the sensor download file. You can find your CID and checksum at the top of the Sensor Downloads page1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 47
To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?
- A. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
- B. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
- C. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
- D. Using IOC management, import the list of hashes and IP addresses and set the action to No Action
Answer: B
NEW QUESTION # 48
While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?
- A. Configure a Containment Policy with the entire internal IP CIDR block
- B. Configure the Host firewall to allowlist the specific IP addresses
- C. Configure a Real Time Response policy allowlist with the specific IP addresses
- D. Configure a Containment Policy with the specific IP addresses
Answer: D
Explanation:
Explanation
While a host is Network contained, the administrator can allow the host to access internal network resources on specific IP addresses to perform patching and remediation by configuring a Containment Policy with the specific IP addresses. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment. Reference: [CrowdStrike Falcon User Guide], page 40.
NEW QUESTION # 49
Which of the following can a Falcon Administrator edit in an existing user's profile?
- A. First or Last name
- B. Phone number
- C. Working groups
- D. Email address
Answer: C
NEW QUESTION # 50
Which of the following is NOT an available filter on the Hosts Management page?
- A. OS Version
- B. Group
- C. Username
- D. Hostname
Answer: C
NEW QUESTION # 51
Which of the following applies to Custom Blocking Prevention Policy settings?
- A. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
- B. You can only blocklist hashes via the API
- C. Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
- D. Blocklisting applies to hashes, IP addresses, and domains
Answer: C
NEW QUESTION # 52
......
CrowdStrike CCFA-200 certification exam covers a wide range of topics related to the Falcon platform, including installation and configuration, endpoint management, threat prevention, incident response, and reporting. Successful candidates will be able to demonstrate their ability to configure and manage the Falcon platform to protect their organization's endpoints from advanced threats. CrowdStrike Certified Falcon Administrator certification is a valuable asset for anyone looking to advance their career in the field of cybersecurity and gain recognition as a skilled Falcon administrator.
Guaranteed Success in CrowdStrike Certified Falcon Administrator CCFA-200 Exam Dumps: https://actualtests.latestcram.com/CCFA-200-exam-cram-questions.html
