2024 Latest CCFA-200 DUMPS Q&As with Explanations Verified & Correct Answers
CCFA-200 dumps Exam Material with 152 Questions
NEW QUESTION # 25
When uninstalling a sensor, which of the following is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies?
- A. Bulk update key
- B. Agent ID (AID)
- C. Maintenance token
- D. Customer ID (CID)
Answer: C
Explanation:
Explanation
When uninstalling a sensor, a maintenance token is required if the 'Uninstall and maintenance protection' setting is enabled within the Sensor Update Policies. This setting prevents unauthorized or accidental uninstallation of sensors by requiring a token that can be generated from the Falcon console. The other options are either incorrect or not related to uninstalling a sensor. Reference: CrowdStrike Falcon User Guide, page
29.
NEW QUESTION # 26
Which of the following best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy?
- A. Prevents modification of sensor update policy
- B. Prevents the sensor from entering Reduced Functionality Mode
- C. Prevents unauthorized uninstallation of the sensor
- D. Prevents automatic updates of the sensor
Answer: C
Explanation:
Explanation
The option that best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy is that it prevents unauthorized uninstallation of the sensor. The Uninstall and Maintenance Protection setting is a feature that adds an extra layer of security to the sensor by requiring a maintenance token to uninstall or update the sensor manually. The maintenance token is a unique code that can be generated by a Falcon Administrator or a Real Time Response -Administrator in the Falcon console. Without a valid maintenance token, the sensor cannot be uninstalled or updated by anyone, including local administrators or malware2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 27
What may prevent a user from logging into Falcon via single sign-on (SSO)?
- A. The user never configured their security questions
- B. Falcon is in reduced functionality mode
- C. The maintenance token has expired
- D. The SSO username doesn't match their email address in Falcon
Answer: D
Explanation:
Explanation
The option that may prevent a user from logging into Falcon via single sign-on (SSO) is that the SSO username doesn't match their email address in Falcon. SSO is a feature that allows you to use an external identity provider (IdP) to authenticate and authorize users to access the Falcon platform. SSO simplifies and streamlines the login process, as users only need to remember one set of credentials for multiple applications.
However, SSO requires that the username in the IdP matches the email address in Falcon for each user. If there is a mismatch between the username and the email address, the user will not be able to log into Falcon via SSO.
References: : [Cybersecurity Resources | CrowdStrike]
NEW QUESTION # 28
Custom IOA rules are defined using which syntax?
- A. Glob
- B. Yara
- C. PowerShell
- D. Regex
Answer: C
NEW QUESTION # 29
What impact does disabling detections on a host have on an API?
- A. DetectionSummaryEvent stops sending to the Streaming API for that host
- B. Endpoints with detections disabled will not alert on anything for 24 hours (by default) or longer if that setting is changed
- C. Endpoints cannot have their detections disabled individually
- D. Endpoints with detections disabled will not alert on anything until detections are enabled again
Answer: A
Explanation:
Explanation
Disabling detections on a host will stop the DetectionSummaryEvent from sending to the Streaming API for that host. This means that the host will not send any detection events to the Streaming API, which is used to stream data from the Falcon Cloud to external applications or systems. The other options are either incorrect or not related to disabling detections on a host. Reference: [CrowdStrike Falcon User Guide], page 32.
NEW QUESTION # 30
What is the function of a single asterisk (*) in an ML exclusion pattern?
- A. The single asterisk is only used to start an expression, and it represents the drive letter
- B. The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path
- C. The single asterisk will match any number of characters, including none. It does include separator characters, such as \ or /, which separate portions of a file path
- D. The single asterisk is the insertion point for the variable list that follows the path
Answer: B
NEW QUESTION # 31
Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?
- A. Sensor Coverage Lookup
- B. Inactive Sensor Report
- C. Sensor Health Report
- D. Reduce Functionality Audit Report
Answer: A
Explanation:
Explanation
The report that lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported is Sensor Coverage Lookup. The Sensor Coverage Lookup report allows you to view and compare the sensor versions and coverage status for each operating system type in your environment. You can use this report to identify any sensors that are in RFM or are approaching end-of-life (EOL) support. You can also view the release date and EOL date for each sensor version3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
NEW QUESTION # 32
How do you assign a Prevention policy to one or more hosts?
- A. Modify the users roles on the User Management page
- B. Ensure the hosts are in a group and assign that group to a custom Prevention policy
- C. Create a new policy and assign it directly to those hosts on the Host Management page
- D. Create a new policy and assign it directly to those hosts on the Prevention policy page
Answer: B
NEW QUESTION # 33
Where can you modify settings to permit certain traffic during a containment period?
- A. Firewall Settings
- B. Containment Policy
- C. Prevention Policy
- D. Host Settings
Answer: B
NEW QUESTION # 34
Where in the Falcon console can information about supported operating system versions be found?
- A. Discover module
- B. Support module
- C. Configuration module
- D. Intelligence module
Answer: B
Explanation:
Explanation
Information about supported operating system versions can be found in the Support module in the Falcon console. This module provides access to various support resources, such as documentation, downloads, FAQs, release notes and system status. One of the documents available in this module is the CrowdStrike Sensor Compatibility List, which lists the supported operating system versions for each sensor type and platform. The other options are either incorrect or not related to finding information about supported operating system versions. Reference: CrowdStrike Falcon User Guide, page 26.
NEW QUESTION # 35
Which is a filter within the Host setup and management > Host management page?
- A. User name
- B. Locality
- C. BIOS Version
- D. OU
Answer: C
NEW QUESTION # 36
How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?
- A. By ensuring each user has set the "pop-ups allowed" in their User Profile configuration page
- B. By selecting "Enable pop-up messages" from the User configuration page
- C. By enabling "Upload quarantined files" in the General Settings configuration page
- D. By turning on the "Notify End Users" setting at the top of the Prevention policy details configuration page
Answer: D
Explanation:
Explanation
A Falcon Administrator can configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity by turning on the "Notify End Users" setting at the top of the Prevention policy details configuration page. This setting allows users to enable or disable end user notifications for prevention actions taken by Falcon on Windows hosts. The other options are either incorrect or not related to configuring pop-up messages. Reference: CrowdStrike Falcon User Guide, page 36.
NEW QUESTION # 37
You have a new patch server that should be reachable while hosts in your environment are network contained.
The server's IP address is static and does not change. Which of the following is the best approach to updating the Containment Policy to allow this?
- A. Add an allowlist entry containing the host group that the server belongs to
- B. Add an allowlist entry for the individual server's MAC address
- C. Add an allowlist entry containing CIDR notation for the /24 network the server belongs to
- D. Add an allowlist entry for the individual server's IP address
Answer: D
Explanation:
Explanation
The best approach to updating the Containment Policy to allow a new patch server that should be reachable while hosts in your environment are network contained is to add an allowlist entry for the individual server's IP address. An allowlist entry allows you to define a list of trusted IP addresses that can communicate with your contained hosts. This way, you can isolate a host from the network while still allowing it to access essential resources or services, such as a patch server. If the server's IP address is static and does not change, adding an individual IP address is more precise and secure than adding a host group or a network range2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 38
How many days will an inactive host remain visible within the Host Management or Trash pages?
- A. 90 days
- B. 15 days
- C. 120 days
- D. 45 days
Answer: A
Explanation:
Explanation
An inactive host will remain visible within the Host Management or Trash pages for 90 days. An inactive host is a host that has not communicated with the Falcon platform for more than seven days. An inactive host will be moved from the Host Management page to the Trash page after seven days of inactivity. An inactive host will remain in the Trash page for 90 days before being permanently deleted from the Falcon platform. You can restore an inactive host from the Trash page if it becomes active again within 90 days1.
References: 1: Falcon Administrator Learning Path | Infographic | CrowdStrike
NEW QUESTION # 39
Why is it important to know your company's event data retention limits in the Falcon platform?
- A. Data such as process records are kept for a shorter time than event data
- B. This is not necessary; you simply select "All Time" in your query to search all data
- C. You will not be able to search event data into the past beyond your retention period
- D. Your query will require you to specify the data pool associated with the date you wish to search
Answer: C
NEW QUESTION # 40
What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?
- A. Computer ID (CID)
- B. Endpoint ID (EID)
- C. Security ID (SID)
- D. Agent ID (AID)
Answer: D
Explanation:
Explanation
The name for the unique host identifier in Falcon assigned to each sensor during sensor installation is Agent ID (AID). The AID is a 32-character hexadecimal string that uniquely identifies each sensor and host in the Falcon platform. The other options are either incorrect or not related to the sensor identifier.
Reference: CrowdStrike Falcon User Guide, page 28.
NEW QUESTION # 41
Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?
- A. \Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill
- B. badguydomain\.com.*
- C. .*badguydomain.com.*
- D. Custom IOA rules cannot be created for domains
Answer: C
Explanation:
Explanation
You are usuing RegEx here and need leading ".*" to capture www and then need a ".*" at the end to identify any sites falling under badguydomain.com
NEW QUESTION # 42
To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?
- A. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
- B. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
- C. Using IOC management, import the list of hashes and IP addresses and set the action to No Action
- D. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
Answer: B
NEW QUESTION # 43
Which of the following is NOT an available action for an API Client?
- A. Retrieve an API Client Secret
- B. Edit an API Client
- C. Reset an API Client Secret
- D. Delete an API Client
Answer: A
Explanation:
Explanation
The option that is not an available action for an API Client is Retrieve an API Client Secret. An API Client is an entity that represents a user or application that can access the Falcon platform programmatically via the Falcon APIs. An API Client has an API Client ID and an API Client Secret, which are used for authenticating and authorizing API requests. You can create and manage API Clients in the API Clients and Keys page in the Falcon console. The available actions for an API Client are Edit an API Client, Reset an API Client Secret, and Delete an API Client. You cannot retrieve an API Client Secret after it has been created, as it is only displayed once during creation for security reasons2.
References: 2: Cybersecurity Resources | CrowdStrike
NEW QUESTION # 44
Which of the following is TRUE regarding Falcon Next-Gen AntiVirus (NGAV)?
- A. The Detection sliders cannot be set to a value less aggressive than the Prevention sliders
- B. Falcon NGAV is not a replacement for Windows Defender or other antivirus programs
- C. Activating Falcon NGAV will also enable all detection and prevention settings in the entire policy
- D. Falcon NGAV relies on signature-based detections
Answer: A
Explanation:
Explanation
The Detection sliders cannot be set to a value less aggressive than the Prevention sliders in Falcon Next-Gen AntiVirus (NGAV). This is because prevention is a subset of detection, and it would not make sense to prevent threats that are not detected. The other options are either incorrect or not true of Falcon NGAV. Reference:
[CrowdStrike Falcon User Guide], page 35.
NEW QUESTION # 45
What can the Quarantine Manager role do?
- A. Manage roles and users
- B. Manage detection settings
- C. Manage and change prevention settings
- D. Manage quarantined files to release and download
Answer: D
Explanation:
Explanation
The Quarantine Manager role can manage quarantined files to release and download. This role allows users to view and search quarantined files, as well as release them from quarantine or download them for further analysis. The other roles do not have this capability. Reference: [CrowdStrike Falcon User Guide], page 19.
NEW QUESTION # 46
Which of the following can a Falcon Administrator edit in an existing user's profile?
- A. Email address
- B. Working groups
- C. Phone number
- D. First or Last name
Answer: D
Explanation:
Explanation
Roles are never called 'working groups' in the documentation. The only other option that can be edited on a existing user is first and last name.
NEW QUESTION # 47
The Logon Activities Report includes all of the following information for a particular user EXCEPT
__________.
- A. the last time the user's password was set
- B. all hosts the user logged into
- C. the account type for the user (e.g. Domain Administrator, Local User)
- D. the logon type (e.g. interactive, service)
Answer: B
Explanation:
Explanation
Checked in console, it returns only the last machine where the user logged on, so it will not return all the machines that the user was logged on in the desired search
NEW QUESTION # 48
......
CrowdStrike CCFA-200 (CrowdStrike Certified Falcon Administrator) Exam is a professional certification exam designed for individuals who wish to demonstrate their expertise in managing and administering the CrowdStrike Falcon platform. CCFA-200 exam is aimed at IT professionals, security administrators, and network administrators who are responsible for the deployment, configuration, and management of the CrowdStrike Falcon platform within their organization.
Share Latest CCFA-200 DUMP Questions and Answers: https://www.exam4labs.com/CCFA-200-practice-torrent.html
CCFA-200 Questions and Answers Guarantee you Oass the Test Easily: https://drive.google.com/open?id=1WZ_a3ZR8y1HURILmQJjYlqMcSrQKfhxK