Free CrowdStrike CCFA-200b Practice Test & Real Exam Questions

Exam Code/Number: CCFA-200b
Exam Name/Title: CrowdStrike Certified Falcon Administrator - 2024 Version
Certification Provider: CrowdStrike
Corresponding Certification: CrowdStrike Certified Falcon Administrator

Exam Questions: 102
Updated On: Sep 13, 2026

Question #10

What are the three required parts of a Fusion SOAR workflow condition?

A. Alert, action, and schedule

B. Operator, value, and source

C. Trigger, parameter, and alert

D. Parameter, operator, and value

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #11

Your security team is noticing that certain privacy-sensitive information such as the URL, HTTP Header and POST bodies are missing from HTTP related detections. What is likely the cause for this?

A. The prevention policy has been configured to redact HTTP detection details

B. The network perimeter firewall blocked the HTTP connection attempts so there was nothing for Falcon to detect

C. The prevention policy was never configured to generate HTTP detections

D. The prevention policy was configured to have an aggressive prevention setting, but only a cautious detection setting

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #12

What is true about User Accounts created by the Falcon Administrator?

A. All User Accounts must start with the domain identifier and number

B. All new User Accounts are created using an employee identification number

C. By default, all User Accounts are created with the Falcon Analyst role

D. All User Accounts must be created with an email address from the list of approved domains

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #13

A member of your SECOPS team is building custom scripts for RTR, but they are unable to save or share them in Falcon. What additional role do they need?

A. Falcon Scripts Manager

B. Real Time Response - Administrator

C. Real Time Response - Active Responder

D. Workflow Author

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #14

How are custom roles assigned to users to perform a specific action on a module?

A. Permissions are enabled in roles, and these roles are assigned to users

B. Permissions are assigned to users directly in user management

C. Users get all permissions by default

D. By adding each module to a role

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #15

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group. What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

A. The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy

B. The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers

C. The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers

D. The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #16

A host has been Network contained with Falcon and you have been asked to update the Operating System with zero day patches. You have tried using your patch update systems for this task, but the jobs fail. Which configuration steps in the Falcon UI will allow these activities?

A. Create a Containment Policy that allow lists the specific IP addresses of your patch management tools

B. Remove Host containment and update the host with all patches

C. Create a Containment Policy that allow lists the Fully Qualified name of your patch management tools

D. Create a Firewall Policy that allow lists your patch management tools

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #17

When troubleshooting a Windows sensor that appears to be installed but is not running, what should be verified to ensure they are installed and running?

A. Windows firewall and internet connectivity to the CrowdStrike cloud

B. Network Store Interface and Network List Service

C. LMHosts and Windows Base Filtering Engine

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #18

What is the fastest way to locate inactive sensors in the Falcon console?

A. Sort hosts by Last Seen timestamp

B. Export all host data to CSV

C. Search for hosts with no Agent ID

D. Filter the Host Management page to show inactive hosts

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Download Free CrowdStrike CCFA-200b Demo

Simply submit your e-mail address below to get started with our free demo of your CrowdStrike CCFA-200b exam.