CrowdStrike Certified Falcon Administrator (CCFA) Practice Test

These questions are part of the practice quiz. Start practicing

• What permissions does a Prevention Policy Manager have?
• To install the Falcon sensor quietly without restarting, which option should be used in the command?
• What does the global containment policy control?
• What is a key feature of Cloud ML in NextGen AV settings?
• When troubleshooting connectivity on a Windows OS, which command is used to confirm connectivity with the Falcon cloud?
• What should you do if certificate pinning or SSL inspection cannot be disabled while using CrowdStrike?
• In the context of policy application, what does dynamic group assignment mean?
• Which function is NOT allowed for the RTR Active Responder role?
• What is a key characteristic of Sensor Visibility Exclusion (SVE)?
• How are hosts in CrowdStrike Falcon typically grouped?
• In a containment policy, whom can change the containment status?
• Which actions can be taken to contain a host?
• Which type of hash is recommended for addition to custom IOCs to avoid issues?
• In Reduced Functionality Mode (RFM), what can the Falcon sensor only send?
• Which action shows a detection as blocked but is not available in detections?
• What happens to the default policy in terms of precedence?
• What is a crucial requirement for sensor deployment regarding network connectivity?
• Where are sensor install logs located if the installation is initiated by a user?
• What action does the "encrypt" command perform in the RTR context?
• In what format does the Remote Access Graph show connections?
• Which type of hash is not recommended due to hash collisions?
• What should be done during Phase 2 of the Prevention Policy implementation?
• What are the two types of host groups within the Falcon platform?
• What is the potential role of a response and containment policy?
• Which report would help identify unusual activity related to scheduled tasks?
• What does 'Sensor Update Policies' control?
• Which task can the Falcon Administrator NOT do by default?
• Who is responsible for managing host groups and firewall rules?
• Which report detail would help identify spawning shells?
• What is one of the default configurations of the Default Policy?
• What specific elements are included in the Visibility Reports?
• The Prevention Policy Audit Trail details changes made to which of the following?
• What capability is included in both On-Sensor and On-Cloud Machine Learning?
• What data does the Mac Sensor Report provide regarding suspicious activity?
• What is the purpose of the cloud connection site 'cloudsink.net'?
• What does the Hunting Reports section in Reporting provide?
• For what purpose are Sensor Visibility Exclusions (SVE) typically used?
• Which of the following best describes the function of Linux sensors in RFM?
• What does the Dashboard Admin role require to access the Falcon Console?
• Which of the following statements is true about the On-Cloud Machine Learning?
• How can a sensor be reverted to a previous version?
• Which command can be added to the installation command to prevent the Falcon sensor from making any proxy connections?
• What is recommended for all operating systems in Phase 3 of the Prevention Policy?
• What type of actions are tracked in the API Audit Trail?
• Which parameter is used for IE proxy detection when installing the Falcon sensor from the command line?
• What is the first step in deleting a user from the Falcon console?
• What is the main function of sensor update policies in CrowdStrike?
• Which role can assign firewall rule groups to firewall policies?
• In the context of alerts, what does RFM stand for?
• What command is used to assign tags to a host in CrowdStrike?
• Which report is essential for checking suspicious activities on Mac hosts?
• What specific type of data does the Preventions Policy Debug Report verify?
• What happens when a host is moved to a policy with no updates selected?
• To uninstall a sensor on Linux, which command would you use for Ubuntu?
• To add a new user in the Falcon console, which steps should be followed?
• What is the recommended setting for Next Gen AV to enable quarantine on files?
• After uninstalling a sensor on Windows, which folder should no longer exist?
• What command line argument is used to install the Falcon sensor on Windows without any prompts or UI elements?
• Which temporary location is used if the Falcon sensor installation is initiated by the CrowdStrike cloud?
• How long are quarantined files retained in the CrowdStrike cloud?
• How can you view the current sensor grouping tags on a Mac?
• How many tags can be added to a single host in the Falcon platform?
• Which Real Time Responder role can run all commands that the RTR Read Only Analyst can and extract files?
• What type of information can you expect to find in the Prevention Hashes Ignored Report?
• What must be verified when checking **SSL/TLS settings** for proper CrowdStrike functionality?
• After deleting a user, what can also be accessed to remove the user?
• Which statement describes the Real Time Responder (RTR) "fake" role?
• What is the character limit for a Falcon grouping tag?
• What can a Falcon Administrator do in the Falcon Console?
• What happens to the detections for a host when detections are disabled in the Falcon console?
• What happens to quarantined files after 90 days in CrowdStrike?
• Which command argument should be included when installing Falcon for Virtual Desktop Infrastructure (VDI)?
• What is a unique capability of the RTR Administrator role?
• Which version of TLS must be enabled for Falcon on commercial cloud clients?
• What is the log file location for Sensor Deployment on Windows OS?
• Which job role allows the management of quarantined files in Prevent Roles?
• What do custom IOA rules monitor?
• Which role is responsible for managing custom IOCs and exclusions?
• Which user role can reset users' credentials and manage detections?
• Which recommendation is suggested for the default policy in sensor update management?
• Which investigation method would you use to search for specific hosts?
• What does disabling detections prevent in the Falcon UI?
• To minimize false positives for required applications, what can be created?
• Which command is used to uninstall a sensor on a Windows offline host?
• What is the significance of 'precedence' in prevention policies?
• Which of the following is NOT a rule type for IOA on Windows?
• Which type of exclusions stop behavioral detections based on command line usage?
• What happens to quarantined files once they are released?
• What is the minimum version requirement for sensor deployment on iOS devices?
• What determines a user account's permissions in the Falcon console?
• What does the GLOB SYNTAX in exclusions help define?
• What requirements must be met for Sensor Deployment on Linux OS?
• What are the responsibilities of a Desktop Support Analyst?
• What is the first step to install Falcon on Windows using the GUI?
• What time frame applies to EAM retention for CrowdStrike data?
• After how many days are detections removed from CrowdStrike?
• What type of hosts can be contained using the containment policy?
• What happens if the sensor cannot connect to CrowdStrike cloud during installation after multiple attempts?
• How long do tags persist if all associated hosts are inactive?
• Which of the following is a guideline when creating Sensor Visibility Exclusions?
• Which command can verify if the sensor is connected to the CrowdStrike cloud?
• What capability does the Endpoint Manager role have in Prevent Roles?
• Which role is required to create and edit IOC management settings?
• What is a potential consequence of unauthorized API secret exposure?
• What is the significance of the Customer Checksum ID (CCID) in Falcon?
• Which of the following is supported as an IOC for Windows, Mac, and Linux?
• Which policy setting is responsible for determining the action on unknown executables?
• What command should be used to set new grouping tags on a Mac for Falcon?
• What is the character limit for Falcon Grouping Tags?
• What purpose does adding known benign files to an allowlist serve?
• How can Mac sensor tags be managed?
• The Remote Access Graph provides what type of visualization?
• What is the default update rate for sensor updates?
• Where can you view build versions for a single sensor?
• What can be used to view the number of sensors in RFM across various reports?
• What is the initial step to uninstall a sensor on a Windows online host?
• How long are quarantined files kept on the host before deletion?
• In terms of roles, what does the term "prevent roles" refer to?
• Which report provides a general overview of a host's status?
• What type of actions can response policies permit during RTR sessions?
• What command is used to find the RFM state from the command line in Linux?
• Which group is recommended for testing updates on a limited number of non-production hosts?
• In sensor update policies, what does 'uninstall protection' prevent?
• Where do you initially navigate to create a containment policy?
• What is a best practice for configuring default policies?
• What happens if Single Sign-On (SSO) is not enabled in an environment?
• What is the primary function of custom alerts in Falcon?
• What can users find in the Unique Host Connecting to Countries Map?
• What does the process of restoring a host from Trash accomplish?
• Which task can only be performed by an RTR Admin?
• In the context of exclusion rules, what does the syntax '*' represent?
• When creating IOA exclusions, which type of detection cannot be excluded?
• What capability is reserved for the Falcon Administrator role?
• Which role has access to create, edit, and delete host groups?
• What functionality is restricted for a Workflow Author role?
• Which service is specifically mentioned for sending notifications through custom workflows?
• What does RFM signify in the context of host management?
• Which of the following best describes the role of prevention policies in CrowdStrike?
• What is the recommended approach for grouping hosts in most cases?
• Which of the following actions can be triggered by custom workflows?
• What can Falcon Security Leads manage?
• What is one of the primary actions of the behavior-based prevention setting?
• What happens if TLS 1.2 is disabled on a Windows machine using Falcon?
• In NextGen AV Settings, which option is categorized as 'Extra Aggressive'?
• Which user role can view the workflows but cannot create or edit them?
• What is the primary function of the Quarantine Manager?
• What is the default wait time set for sensor installation if timing out?
• What happens to new detections after a host is deleted in the system?
• What must be done to use quarantine on Windows Server 2016 and 2019?
• Which of the following is NOT a primary filter available in the Host Management section?
• What is the minimum operating system requirement for deploying sensors on Android devices?
• What command can you use to load the Falcon sensor after updating its grouping tags on a Mac?
• What role does the Falcon Security Lead have regarding user password management?
• Where can you find inactive sensors in the CrowdStrike console?
• What does the command 'CsUninstallTool.exe /quiet' accomplish?
• Which of the following actions allows the indicator to be saved but takes no action?
• Which of the following is a requirement for Falcon to be supported on a server?
• What is the main responsibility of a Falcon Analyst in Prevent Roles?
• Which role is responsible for creating and editing workflows?
• What action can you take to modify a user's first and last name?
• What notification is shown to users when the Falcon sensor performs a blocking action?
• What access does a Falcon Analyst have in relation to host management?
• What does SVE primarily aim to protect against?
• What information is needed to add IOCs to the management system?
• What is the main function of a containment policy in CrowdStrike?
• In sensor update policies, which two operating systems share the same settings?
• What does the 'NO_START=1' command do during the Falcon installation on a VM?
• What information does the Falcon UI Audit Trail Report provide?
• What is the purpose of using the '/norestart' command in the Falcon installation on Windows?
• Which operating system does NOT have Reduced Functionality Mode (RFM)?
• Which of the following actions is NOT included in a Linux sensor report?
• How can you check the number of devices in RFM?
• What can a Falcon Administrator do in terms of user management?
• When installing Falcon on Windows, what do the tags in the command represent?
• Hunting Reports in CrowdStrike mainly provide information regarding?
• What function does Sensor Visibility serve in policy settings?
• What is the intended outcome of applying file pattern exclusions to groups?
• What is one of the prerequisites for installing Falcon on a Mac?
• When installing the Falcon sensor in a virtual environment, which parameter should be included?
• What type of information can the Falcon Analyst read concerning firewall?
• Which registry key should be checked to confirm the DNS cache is correctly set up for the CrowdStrike agent?
• Which statement correctly describes the Reduced Functionality Mode (RFM) for Windows?
• What is the maximum number of hosts you can add to a static host group at one time?
• Which of the following is true about the containment policy?
• Which error code refers to a communications problem between CrowdStrike Cloud and the host?
• What does the RFC in "RTR" stand for in the context of CrowdStrike?
• Which of the following areas does Behavior-Based Prevention cover?
• What is the purpose of a sensor update policy?
• Which role can re-execute failed workflows?
• What is required to add IOCs from the Detections page?
• Who can reset another user's password in the Falcon system?
• What happens when detections are disabled for a host?
• What command can be used to check if the Falcon agent is running on a Windows system?
• Which parameter is used to ensure the Falcon sensor installation occurs without immediate launch?
• What information must you specify in the installation command for the Falcon sensor on Windows regarding the proxy?
• Active connection data from which command indicates the sensor's connection to CrowdStrike cloud?
• What information does the Logon Activity Report provide about failed login attempts?
• What happens to the API information if the secret is compromised?
• What is the primary purpose of the Auto-Complete feature in the filter bar?
• What type of notification can you send using custom workflows to inform users?
• What action is triggered if a process matches a custom IOA rule?
• What key feature must be enabled in all working update policies?
• What effect does RFM have on a Windows sensor immediately after an update?
• How are Falcon grouping tags added to a host?
• What does the Machine-Learning Prevention Monitoring Report show?
• What type of environments are static host groups particularly useful for?
• What action can the Falcon Analyst perform regarding quarantined files?
• What is the default policy in CrowdStrike primarily used for?
• What must be confirmed when disabling detections for a host?
• How can hosts be assigned to a dynamic host group?
• When using exclusion patterns, what should you ensure about paths that include spaces?
• What key infrastructure is necessary for the CrowdStrike sensor to operate successfully in a proxy environment?
• Which service is NOT required for Sensor Deployment on Windows OS?
• What is the primary recommendation for implementing Prevention Policies for new customers?
• What additional capability does the RTR Active Responder possess that the RTR Read Only Analyst does not?
• What type of host group allows the use of filters to define its members?
• Where can the sensor update policies be managed?
• What type of roles can the Falcon Administrator assign to users?
• What is the main scenario where reduced functionality mode (RFM) is most commonly encountered?
• What is the recommended installation method for Falcon on a Mac?
• Which cloud behavior indicates the sensor is installed on the host during RFM?
• Which action should be performed after selecting "Delete User" in the Falcon console?
• During the installation process, what must be accepted to proceed with Falcon installation?
• Which URL relates to the US-2 CrowdStrike deployment?
• Force Address Space Layout Randomization (ASLR) bypass prevention is classified as?
• What is a key component of the containment policy?
• When deploying sensors on hosts using proxies, which protocol is important to enable?
• What is the purpose of ML exclusions?
• What is the primary function of Malware Protection in CrowdStrike's policy settings?
• To install the Falcon sensor using the 'Pay as you go' billing type, which parameters are needed?
• Which role can view dashboards and manage sensor update policies?
• How can you uninstall the sensor on a Mac system?
• What is the primary purpose of IOA exclusions in CrowdStrike?
• What must be true about the email address when enabling Single Sign-On?
• Which command is used to execute the installation of Falcon on a Mac via command line?
• Which setting would you choose to ensure a suspicious file is prevented from executing but not shown in detections?
• What does the term "precedence" refer to in policy management in CrowdStrike?
• Which role allows a user to view detections and manage host management?
• Who can create, edit, manage, and delete dashboards?
• Where can you apply filters to show hosts in Reduced Functionality Mode (RFM)?
• What is the effect on the DetectionSummaryEvent when detections are disabled for a host?
• What is the maximum number of hosts that can be added to a static host group at a time?
• What is the purpose of the Linux Sensors Report in relation to host reporting?
• How long do inactive sensors remain retained before being removed from the UI?
• What occurs to hosts that are deleted in CrowdStrike Falcon?
• What mode does the Falcon sensor operate in if installed on an unsupported kernel version?
• What can you do if you need a longer EAM retention period than the default of 7 days?
• Which role in Prevent Roles allows viewing and managing remediation actions?
• What limitation does the RTR Read Only Analyst have compared to other roles?
• In the context of preparing a VM for cloning, what must you do AFTER installing the Falcon sensor?
• The Remote or Network Logon Activity Report focuses on which type of login?
• What must be running for Web Proxy Automatic Discovery (WPAD) to work during Sensor Deployment?
• Which feature helps in grouping tags assigned to a host?
• What kind of detections does an IOA exclusion stop?
• Which of the following is NOT a feature of sensor update policies?
• What command would you use to verify if the Falcon sensor is running on a Windows host?
• What is a key function of the Firewall Manager?
• Which of the following is a necessary action if network configurations interfere with certificate validation?
• What is the function of glob syntax in creating file exclusion rules?
• What syntax is used for defining patterns in ML exclusions?
• What do ML exclusions prevent apart from stopping file uploads to the CrowdStrike cloud?
• Which action should be performed to resolve communication issues with CrowdStrike endpoints?
• What key details does the Prevention Policy Debug Report display?
• What type of tags are only added when adding sensors in the Falcon platform?
• What characterizes Phase 1 of the Prevention Policy implementation?
• Which location is designated for quarantined files on Windows?
• What type of data does the Logon Activity Report aggregate?
• What is the purpose of utilizing commands like "encrypt" in RTR?
• Which deployment strategy updates sensors to the newest versions as released?
• What is one method to uninstall the Falcon sensor on Windows?
• How are ML exclusions created?
• Which of the following items would you expect to find in a Linux sensor report?
• What does precedence ensure in sensor update policies?
• What can an Endpoint Manager do?
• Which feature must be disabled to prevent man-in-the-middle attacks during sensor installation?
• Which of the following is correct regarding file pattern exclusions for different operating systems?
• What information can be gathered using the command 'uname -r' on Linux?
• How are prevention policies configured in CrowdStrike?
• Which role has the ability to create and manage machine learning exclusions?
• What remains in Event Search after disabling detections for a host?
• Which tool can be downloaded to aid in uninstalling a sensor on a Windows online host?
• What does the acronym AID stand for in relation to Falcon agents?
• What type of actions cannot be included by a Workflow Author without an additional role?
• How does containment impact a host's connectivity to the CrowdStrike cloud?
• Which role is required to create custom IOA rules?
• What parameter is used to assign tags to a host during installation?
• In RTR roles, which role is synonymous with having no rights?
• Which action is unnecessary when creating new exclusions in CrowdStrike?
• What happens to events when IOA exclusions are applied?
• Which roles can view exclusions and exclusion audit logs?
• Which feature allows for the dynamic assignment of hosts to groups based on custom keywords?
• What kind of command line activity can be monitored in the Hunting Reports?
• What is a limitation of a Falcon Security Lead regarding user management?
• What does the Sensor Capabilities setting influence?
• What type of information is provided in the Linux Sensors report?
• In which scenario is it best to disable updates?
• How are prevention policy settings typically determined?
• Which role is NOT able to edit custom workflows in Falcon?
• What is the required value for the registry key in Windows OS sensor deployment?
• What key must be configured for Sensor Deployment on Windows OS?
• What happens to sensor grouping tags when they are removed from all hosts?
• What does the auto-update setting "Auto N-1" do?
• What should be used if a host requires more provisioning time during sensor installation?
• What is a recommended practice when creating groups in CrowdStrike?
• Which user role has the ability to execute the "encrypt" command in CrowdStrike?