CrowdStrike CCFA-200b Exam Questions Instant Access

Question 1

When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

ACustom IOA Rule Groups

BCustom IOC Groups

CEnterprise Groups

DOperating System Groups

Answer : A

Prevention Policies are created based on the OS (Windows, MAC and Linux policies). Once a prevention policy is created, three options appear on top: Settings, Assigned Host Groups and Assigned Custom IOAS (tested on Crowdstrike). Therefore, Host Groups and Custom IOAS are the two different types of groups a prevention policy can be aligned to.

Question 2

What best describes the relationship between Sensor Update policies and Operating Systems?

AWindows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions

BSensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems

CWindows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies

DA Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)

Answer : D

The option that describes the relationship between Sensor Update policies and Operating Systems is that a Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux). This option is essentially a repetition of question 141 and its answer. Sensor Update policies are specific to each operating system type, as different operating systems have different sensor versions, features, and requirements.Therefore, you need to create and assign separate Sensor Update policies for each operating system type in your environment1.

Question 3

Under which scenario can Sensor Tags be assigned?

AWhile triaging a detection

BWhile managing hosts in the Falcon console

CWhile updating a sensor in the Falcon console

DWhile installing a sensor

Answer : D

Check in documentation, there are two kind of tags, the Falcon Grouping Tags that can be managed in falcon console or API and the Sensor Grouping Tags that are configured as parameter in cli, that kind of tags can be diferentiated because it appears with the prefix SensorGroupingTags followed with the name of the tag. If you want to modify a sensor tag is necessary change a registry key value and reboot the device or waiting until the sensor is upgraded.

Question 4

What model is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform?

AFor - While statement(s)

BTrigger, condition(s) and action(s)

CEvent trigger(s)

DPredefined workflow template(s)

Answer : B

The model that is used to create workflows that would allow you to create custom notifications based on particular events which occur in the Falcon platform is trigger, condition(s) and action(s). This model allows you to specify what event will trigger the workflow, what condition(s) must be met for the workflow to execute, and what action(s) will be performed by the workflow. The other options are either incorrect or not related to creating workflows. Reference:CrowdStrike Falcon User Guide, page 56.

Question 5

Which of the following is NOT an available action for an API Client?

AEdit an API Client

BReset an API Client Secret

CRetrieve an API Client Secret

DDelete an API Client

Answer : C

The option that is not an available action for an API Client is Retrieve an API Client Secret. An API Client is an entity that represents a user or application that can access the Falcon platform programmatically via the Falcon APIs. An API Client has an API Client ID and an API Client Secret, which are used for authenticating and authorizing API requests. You can create and manage API Clients in the API Clients and Keys page in the Falcon console. The available actions for an API Client are Edit an API Client, Reset an API Client Secret, and Delete an API Client.You cannot retrieve an API Client Secret after it has been created, as it is only displayed once during creation for security reasons2.

Question 6

What information does the API Audit Trail Report provide?

AA list of analyst login activity

BA list of specific changes to prevention policy

CA list of actions taken via Falcon OAuth2-based APIs

DA list of newly added hosts

Answer : C

The information that the API Audit Trail Report provides is a list of actions taken via Falcon OAuth2-based APIs. The API Audit Trail Report allows you to view and audit the activity and usage of the Falcon APIs by different API clients and users in your organization.You can use this report to monitor who accessed what data, when, and how via the Falcon APIs2.

Question 7

You notice there are multiple Windows hosts in Reduced functionality mode (RFM). What is the most likely culprit causing these hosts to be in RFM?

AA Sensor Update Policy was misconfigured

BA host was offline for more than 24 hours

CA patch was pushed overnight to all Windows systems

DA host was placed in network containment from a detection

Answer : C

The most likely culprit causing multiple Windows hosts to be in Reduced Functionality Mode (RFM) is a patch that was pushed overnight to all Windows systems. RFM occurs when the sensor detects a change in the operating system that requires a reboot to complete. A patch is one of the common causes of such a change. The other options are either incorrect or not related to RFM. Reference:CrowdStrike Falcon User Guide, page 30.

CrowdStrike Certified Falcon Administrator CCFA-200b Exam Questions