Get all the Information About CrowdStrike CCFA-200 Exam 2024 Practice Test Questions [Q17-Q35]

4/5 - (1 vote)

Get all the Information About CrowdStrike CCFA-200 Exam 2024 Practice Test Questions

Check Real CrowdStrike CCFA-200 Exam Question for Free (2024)

CrowdStrike Falcon platform is a cloud-based endpoint security solution that provides real-time threat intelligence, detection, and response capabilities. It is designed to protect organizations against advanced threats, malware, and other cyber attacks. The platform is built on a modern architecture that leverages machine learning, behavioral analysis, and threat intelligence to detect and respond to threats in real-time.

To prepare for the CCFA-200 exam, candidates can take advantage of CrowdStrike’s training resources, including online courses, webinars, and documentation. These resources cover all aspects of the Falcon platform, from basic installation and configuration to advanced threat hunting and incident response. Candidates can also participate in online forums and discussion groups to connect with other Falcon administrators and share best practices and tips.

QUESTION 17
Which statement is TRUE regarding disabling detections on a host?

Hosts with detections disabled will not alert on blocklisted hashes or machine learning detections, but will still alert on lOA-based detections. It will remain that way until detections are enabled again

Hosts with detections disabled will not alert on anything until detections are enabled again

Hosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed

Hosts cannot have their detections disabled individually

Explanation
The statement that is true regarding disabling detections on a host is that hosts with detections disabled will not alert on anything until detections are enabled again. As explained in question 127, disabling detections for a host will stop the sensor from sending any detection or prevention events to the Falcon console, and remove any existing events for that host from the console. This means that the host will not alert on anything, including blocklisted hashes, machine learning detections, or indicator of attack (IOA)-based detections. The host will remain in this state until detections are enabled again1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

QUESTION 18
You have been asked to troubleshoot why Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host. Which report can be used to determine if this is an issue with an old prevention policy?

Host Update Status Report

Custom Alerting Audit Trail

Prevention Policy Debug

SBEM Debug Report

Explanation
The report that can be used to determine if Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host due to an old prevention policy is Prevention Policy Debug. The Prevention Policy Debug report allows you to view and compare the prevention policy settings applied to each host in your environment. You can use this report to identify any hosts that have outdated or inconsistent prevention policy settings, such as SBEM, which is a feature that monitors and prevents malicious script execution on Windows systems1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

QUESTION 19
When troubleshooting the Falcon Sensor on Windows, what is the correct parameter to output the log directory to a specified file?

LOG=log.txt

log log.txt

C:CSSensorlnstallLogFiles

/log log.txt

Explanation
The correct parameter to output the log directory to a specified file when troubleshooting the Falcon Sensor on Windows is /log log.txt. This parameter will create a log file named log.txt in the same folder where you run the sensor installation command. The log file will contain information about the sensor installation process, such as the parameters used, the actions performed, and any errors encountered3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator

QUESTION 20
You are evaluating the most appropriate Prevention Policy Machine Learning slider settings for your environment. In your testing phase, you configure the Detection slider as Aggressive. After running the sensor with this configuration for 1 week of testing, which Audit report should you review to determine the best Machine Learning slider settings for your organization?

Prevention Policy Audit Trail

Prevention Policy Debug

Prevention Hashes Ignored

Machine-Learning Prevention Monitoring

QUESTION 21
Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?

Falcon NGAV relies on signature-based detections

Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy

The Detection sliders cannot be set to a value less aggressive than the Prevention sliders

Falcon NGAV is not a replacement for Windows Defender or other antivirus programs

Explanation
The Detection sliders cannot be set to a value less aggressive than the Prevention sliders in Falcon Next-Gen AntiVirus (NGAV). This is because prevention is a subset of detection, and it would not make sense to prevent threats that are not detected. The other options are either incorrect or not true of Falcon NGAV. Reference:
[CrowdStrike Falcon User Guide], page 35.

QUESTION 22
Which role will allow someone to manage quarantine files?

Falcon Security Lead

Detections Exceptions Manager

Falcon Analyst – Read Only

Endpoint Manager

QUESTION 23
How are user permissions set in Falcon?

Permissions are token-based. Users request access to a defined set of permissions and an administrator adds their token to the set of permissions

An administrator selects individual granular permissions from the Falcon Permissions List during user creation

Permissions are assigned to a User Group and then users are assigned to that group, thereby inheriting those permissions

Pre-defined permissions are assigned to sets called roles. Users can be assigned multiple roles based on job function and they assume a cumulative set of permissions based on those assignments

QUESTION 24
Where can you modify settings to permit certain traffic during a containment period?

Prevention Policy

Host Settings

Containment Policy

Firewall Settings

QUESTION 25
The Logon Activities Report includes all of the following information for a particular user EXCEPT
__________.

the account type for the user (e.g. Domain Administrator, Local User)

all hosts the user logged into

the logon type (e.g. interactive, service)

the last time the user’s password was set

Explanation
Checked in console, it returns only the last machine where the user logged on, so it will not return all the machines that the user was logged on in the desired search

QUESTION 26
When editing an existing IOA exclusion, what can NOT be edited?

The IOA name

All parts of the exclusion can be changed

The exclusion name

The hosts groups

Explanation
When editing an existing IOA exclusion, the IOA name cannot be edited. An IOA (indicator of attack) exclusion allows you to define custom rules for excluding suspicious behavior from detection or prevention based on process execution, file write, network connection, or registry events. The IOA name is a predefined name that identifies the type of IOA behavior that you want to exclude, such as “Suspicious Process Execution
– Script Interpreter Executing File”. The IOA name cannot be changed when editing an existing IOA exclusion, as it is linked to a specific IOA rule in the Falcon platform. However, you can edit other parts of the IOA exclusion, such as the exclusion name, the hosts groups, and the filter criteria2.
References: 2: Cybersecurity Resources | CrowdStrike

QUESTION 27
The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

SSL inspection should be configured to occur on all Falcon traffic

Some network configurations, such as deep packet inspection, interfere with certificate validation

HTTPS interception should be enabled to proceed with certificate validation

Common sources of interference with certificate pinning include protocol race conditions and resource contention

QUESTION 28
Which is the correct order for manually installing a Falcon Package on a macOS system?

Install the Falcon package, then register the Falcon Sensor via the registration package

Install the Falcon package, then register the Falcon Sensor via command line

Explanation
The correct order for manually installing a Falcon Package on a macOS system is to install the Falcon package, then register the Falcon Sensor via command line. The Falcon package contains the sensor binary and the kernel extension, while the registration package contains the customer ID and the sensor group ID. The registration package is not required for macOS systems, as the registration information can be provided via command line after installing the Falcon package1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike

QUESTION 29
Which port and protocol does the sensor use to communicate with the CrowdStrike Cloud?

TCP port 22 (SSH)

TCP port 443 (HTTPS)

TCP port 80 (HTTP)

TCP UDP port 53 (DNS)

Explanation
The sensor uses TCP port 443 (HTTPS) to communicate with the CrowdStrike Cloud. This port and protocol are used to securely send and receive data between the sensor and the cloud, such as detections, policies, updates, commands, etc. The other options are either incorrect or not used by the sensor.
Reference: CrowdStrike Falcon User Guide, page 28.

QUESTION 30
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

Edit the Default Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Edit the Default Response Policy and add the host group to the exceptions list under “Real Time Functionality”

Create a new Response Policy, toggle the “Real Time Response” switch off and assign the policy to the host group

Create a new Response Policy and add the host name to the exceptions list under “Real Time Functionality”

QUESTION 31
Which of the following is NOT a way to determine the sensor version installed on a specific endpoint?

Use the Sensor Report to filter to the specific endpoint

Use the Investigate > Host Search to filter to the specific endpoint

Use Host Management to select the desired endpoint. The agent version will be listed in the columns and details

From a command line, run the sc query csagent -version command

Explanation
From a command line, running the sc query csagent -version command is not a way to determine the sensor version installed on a specific endpoint. This command will only show the status of the csagent service, not the sensor version. The other options are valid ways to determine the sensor version installed on a specific endpoint using Falcon UI or API. You can use the Sensor Report, the Host Search, or the Host Management features to filter, search, or select the desired endpoint and view the sensor version information12.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike 2: How to Become a CrowdStrike Certified Falcon Administrator

QUESTION 32
Which of the following is TRUE of the Logon Activities Report?

Shows a graphical view of user logon activity and the hosts the user connected to

The report can be filtered by computer name

It gives a detailed list of all logon activity for users

It only gives a summary of the last logon activity for users

Explanation
The Logon Activities Report shows a graphical view of user logon activity and the hosts the user connected to, but it only gives a summary of the last logon activity for users. It does not give a detailed list of all logon activity for users, nor can it be filtered by computer name. The other options are either incorrect or not true of the report. Reference: CrowdStrike Falcon User Guide, page 50.

QUESTION 33
Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?

Reduce Functionality Audit Report

Sensor Health Report

Sensor Coverage Lookup

Inactive Sensor Report

Explanation
The report that lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported is Sensor Coverage Lookup. The Sensor Coverage Lookup report allows you to view and compare the sensor versions and coverage status for each operating system type in your environment. You can use this report to identify any sensors that are in RFM or are approaching end-of-life (EOL) support. You can also view the release date and EOL date for each sensor version3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator

QUESTION 34
In order to exercise manual control over the sensor upgrade process, as well as prevent unauthorized users from uninstalling or upgrading the sensor, which settings in the Sensor Update Policy would meet this criteria?

Sensor version set to N-1 and Bulk maintenance mode is turned on

Sensor version fixed and Uninstall and maintenance protection turned on

Sensor version updates off and Uninstall and maintenance protection turned off

Sensor version set to N-2 and Bulk maintenance mode is turned on

QUESTION 35
You want to create a detection-only policy. How do you set this up in your policy’s settings?

Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.

Select the “Detect-Only” template. Disable hash blocking and exclusions.

You can’t create a policy that detects but does not prevent. Use Custom IOA rules to detect.

Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.

Explanation
The administrator can create a detection-only policy by setting the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled in the policy’s settings. This will allow Falcon to detect but not prevent threats on the hosts using this policy. Do not activate any of the other blocking or malware prevention options, as they will enable prevention actions. The other options are either incorrect or not related to creating a detection-only policy. Reference: [CrowdStrike Falcon User Guide], page 35.

Loading …