Logo ExamsQA
Exit
Official Bank 0/151

CrowdStrike Certified Falcon Administrator (CCFA-200b) - CrowdStrike Exam Questions

Last updated on July 22, 2026

97% Exam Compliance
151 Total Questions
1
Question
You have a new patch server that should be reachable while hosts in your environment are network contained. The server's IP address is static and does not change. Which of the following is the best approach to updating the Containment Policy to allow this?
Options
A Add an allowlist entry for the individual server's MAC address
B Add an allowlist entry containing the host group that the server belongs to
C Add an allowlist entry containing CIDR notation for the /24 network the server belongs to
D Add an allowlist entry for the individual server's IP address
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

2
Question
What may prevent a user from logging into Falcon via single sign-on (SSO)?
Options
A The SSO username doesn't match their email address in Falcon
B Falcon is in reduced functionality mode
C The user never configured their security questions
D The maintenance token has expired
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

3
Question
The Falcon Administrator has created a new prevention policy to apply to the "Servers" group;
however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?
Options
A The new prevention policy should be enabled first
B The "Servers" group must be disabled first
C Host type was not defined correctly within the prevention policy
D The "Servers" group already has a policy applied to it
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

4
Question
To enhance your security, you want to detect and block based on a list of domains and IP addresses.

How can you use IOC management to help this objective?
Options
A Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
B Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
C Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
D Using IOC management, import the list of hashes and IP addresses and set the action to No Action
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

5
Question
What would be the most appropriate action to take if you wanted to prevent a folder from being uploaded to the cloud without disabling uploads globally?
Options
A A Machine Learning exclusion
B A Sensor Visibility exclusion
C An IOA exclusion
D A Custom IOC entry
Discussion (0 comments)

to join the discussion

Community Discussion

No discussions yet. Be the first to ask!

Finish Practice?

Are you sure you want to finish? This will end your practice session.