Free CrowdStrike CCFA-200b Practice Test & Real Exam Questions

Exam Code/Number: CCFA-200b
Exam Name/Title: CrowdStrike Certified Falcon Administrator - 2024 Version
Certification Provider: CrowdStrike
Corresponding Certification: CrowdStrike Certified Falcon Administrator

Exam Questions: 102
Updated On: Sep 13, 2026

Question #1

When using Microsoft Windows, what command verifies that a Falcon Sensor is running?

A. netstat.exe -f

B. sc.exe query csagent

C. cswindiag.exe -status

D. sc.exe query falcon

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #2

An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?

A. 45 Days

B. 90 Days

C. 60 Days

D. 75 Days

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #3

From the Host management page, what is the best field to filter by for Domain Controllers to obtain sensor version information?

A. Platform

B. Type

C. OS Version

D. Sensor Version

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #4

Where would you apply a configuration to allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained?

A. Maintenance Token

B. IP Allowlist Management

C. Containment Policy

D. Response Policies

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #5

How can you search for multiple hostnames at the same time via Host Management?

A. Enter the multiple hostnames in the Hostname filter separating each by a comma

B. Add the Hostname filter multiple times and enter separate hostnames into each filter

C. Enter the multiple hostnames in the Hostname filter separating each by a decimal

D. Add the Multiple Hostnames filter and enter your list of hostnames

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #6

What is the primary purpose of custom IOA rules?

A. Manage system updates

B. Identify malicious behavior

C. Configure network settings

D. Block known malware

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #7

Which ML exclusion pattern would be the most accurate for all .exe binaries in "C:\Program Files\Software\", including any subfolders of Software?

A. ***.exe

B. Program Files\Software* *.exe

C. Program Files\Software*.exe

D. Program Files\Software* .exe

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #8

Why would you add IP addresses to a containment policy?

A. Your organization has additional IP addresses that need to be able to access the Falcon console

B. A new group of analysts need to be able to place hosts under Network Containment

C. You want to automate the Network Containment process based on the IP address of a host

D. Your organization has resources that need to be accessible when hosts are network contained

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #9

What is the highest level of protection for a prevention policy?

A. Phase 3

B. Phase 2

C. Phase 1

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Download Free CrowdStrike CCFA-200b Demo

Simply submit your e-mail address below to get started with our free demo of your CrowdStrike CCFA-200b exam.