Pre-Winter Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65pass65

Free CrowdStrike Falcon Certification Program Practice Questions

Exams4sure Dumps

Exam style questions across every CCFA-200b domain

Last Update 2 days ago
Total Questions : 100

Start with our free CCFA-200b practice questions, carefully crafted to mirror the domains, phrasing, and difficulty of the real CrowdStrike Falcon Certification Program exam. Each CCFA-200b exam question comes with a detailed rationale that explains not just which answer is correct but why the others fall short. That's how concepts stick. Use the free set to benchmark yourself: identify your CrowdStrike weak domains, see where you're losing marks, and build a focused study plan in minutes.

CCFA-200b PDF

CCFA-200b PDF (Printable)
$54.25
$154.99

CCFA-200b Testing Engine

CCFA-200b PDF (Printable)
$59.5
$169.99

CCFA-200b PDF + Testing Engine

CCFA-200b PDF (Printable)
$74.55
$212.99
Question # 1

Which role allows management of quarantined files?

Options:

A.  

Falcon Analyst – Read Only

B.  

Detections Exceptions Manager

C.  

Falcon Security Lead

D.  

Endpoint Manager

Discussion 0
Question # 2

What policy setting should be selected for a new host when it has an existing antivirus?

Options:

A.  

Extra Aggressive Level ML

B.  

Aggressive Level ML

C.  

Moderate Level ML

D.  

Cautious Level ML

Discussion 0
Question # 3

You want to add an additional layer of security to high-risk Real Time Response commands for your environment. Where do you configure MFA for RTR within the UI?

Options:

A.  

General settings

B.  

Notifications

C.  

Response policies

D.  

Containment policy

Discussion 0
Question # 4

You have 100 hashes that have been prohibited by management and need to be blocked within your organization. Using Falcon, what is the best way to accomplish this?

Options:

A.  

Navigate to Configure > IOC Management. Add a custom IO

C.  

Add the list of hashes. Set the action to Block. Verify the prevention policy includes Custom Blocking under Execution Blocking.

B.  

Navigate to Configure > Prevention policies. Add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block. Verify Custom Execution Blocking is active.

C.  

Navigate to Configure > IOC Management. Add a custom Prevention Policy. Add the list of hashes. Set the action to Block. Verify the policy includes Custom Execution Blocking.

D.  

Navigate to Configure > Prevention policies. Add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block and Alert. Verify Custom Blocking inside Execution Blocking is active.

Discussion 0
Question # 5

You can create Fusion SOAR workflows to precisely define the actions you want Falcon to perform in response to incidents. Which three items must be defined in every trigger so that it executes successfully?

Options:

A.  

Trigger, Condition, Action

B.  

Rule Type, Condition, Action

C.  

Rule Type, Filter, Objective

D.  

Trigger, Filter, Objective

Discussion 0
Question # 6

When configuring a third-party integration to communicate with the Falcon API, which credential combination must be generated first?

Options:

A.  

Access Key and Secret Key

B.  

Integration Key and Customer ID

C.  

API Client and Secret Key

D.  

OAuth2 Token and Client Secret

Discussion 0
Question # 7

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group. What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

Options:

A.  

The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers

B.  

The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers

C.  

The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy

D.  

The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

Discussion 0
Question # 8

Where would you apply a configuration to allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained?

Options:

A.  

IP Allowlist Management

B.  

Containment Policy

C.  

Response Policies

D.  

Maintenance Token

Discussion 0
Question # 9

You have created a new static host group to test a newly created sensor update policy, and need to add 500 servers into the group. You want to upload a list of hosts to Falcon for automatic addition into the group. What file format must the list be for this to be successfully accomplished?

Options:

A.  

XLSX

B.  

PDF

C.  

TXT

D.  

JSON

Discussion 0
Question # 10

Using Host setup and management inside the Falcon Console, how can you display sensors in Reduced Functionality Mode?

Options:

A.  

From Host management, filter for RFM

B.  

From Host status, filter for RFM

C.  

From Sensor health, sort using the column heading Sensor status

D.  

From Sensor status, click on the widget RFM

Discussion 0

Free Exams Sample Questions