CrowdStrike CCFA-200b Actual Free Exam Questions & Community Discussion

Exam Code/Number: CCFA-200b
Exam Name/Title: CrowdStrike Certified Falcon Administrator - 2024 Version
Certification Provider: CrowdStrike
Corresponding Certification: CrowdStrike Certified Falcon Administrator

Exam Questions: 102
Updated On: Aug 04, 2026

Question #28

What prevention policy setting prevents sensor-related files, folders, and registry objects from being renamed or deleted?

A. System Configuration Protection

B. Host Modification Protection

C. Sensor Tampering Protection

D. Sensor Modification Protection

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #29

What happens to detections in the console after clicking "Disable Detections" for a host from within the Host Management page?

A. Existing detections for the host remain

B. All detection data for the host is deleted and the host is hidden from view

C. The detections for the host are removed from the console immediately

D. New detections are disabled for 30 days

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #30

A host has been Network contained with Falcon and you have been asked to update the Operating System with zero day patches. You have tried using your patch update systems for this task, but the jobs fail. Which configuration steps in the Falcon UI will allow these activities?

A. Create a Containment Policy that allow lists the Fully Qualified name of your patch management tools

B. Remove Host containment and update the host with all patches

C. Create a Containment Policy that allow lists the specific IP addresses of your patch management tools

D. Create a Firewall Policy that allow lists your patch management tools

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #31

What policy setting should be selected for a new host when it has an existing antivirus?

A. Extra Aggressive Level ML

B. Cautious Level ML

C. Moderate Level ML

D. Aggressive Level ML

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #32

You are assigning sensor group tags during installation. What is the maximum allowed length of all tags?

A. 256 characters

B. 100 characters

C. 237 characters

D. 50 characters

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #33

Which ML exclusion pattern would be the most accurate for all .exe binaries in "C:\Program Files\Software\", including any subfolders of Software?

A. Program Files\Software* .exe

B. ***.exe

C. Program Files\Software* *.exe

D. Program Files\Software*.exe

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #34

You have 100 hashes that have been prohibited by management and need to be blocked within your organization. Using Falcon, what is the best way to accomplish this?

A. Navigate to Configure > IOC Management. Add a custom IOC. Add the list of hashes. Set the action to Block. Verify the prevention policy includes Custom Blocking under Execution Blocking.

B. Navigate to Configure > Prevention policies. Add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block. Verify Custom Execution Blocking is active.

C. Navigate to Configure > Prevention policies. Add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block and Alert. Verify Custom Blocking inside Execution Blocking is active.

D. Navigate to Configure > IOC Management. Add a custom Prevention Policy. Add the list of hashes. Set the action to Block. Verify the policy includes Custom Execution Blocking.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #35

Which report would show you an overview of the top ten most-applied policies by sensors in your environment?

A. Scheduled reports

B. Sensor report dashboard

C. Sensor policy daily report

D. Executive summary

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #36

Which Windows prevention policy setting monitors contents of shells for execution of malicious content?

A. Enhanced exploitation visibility

B. Additional user mode data visibility

C. Script-based execution visibility

D. Suspicious Scripts and Commands

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free CrowdStrike CCFA-200b Demo

Simply submit your e-mail address below to get started with our free demo of your CrowdStrike CCFA-200b exam.