Printable & Easy to Use CCFA-200b Dumps 100% Same Q&A In Your Real Exam
CCFA-200b Practice Test Give You First Time Success with 100% Money Back Guarantee!
CrowdStrike CCFA-200b Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 19
During a sensor installation, what unique identifier is given to each sensor?
- A. Endpoint ID (EID)
- B. Agent ID (AID)
- C. Security ID (SID)
- D. Computer ID (CID)
Answer: B
NEW QUESTION # 20
Which is a filter within the Host setup and management > Host management page?
- A. Locality
- B. BIOS Version
- C. OU
- D. User name
Answer: C
Explanation:
OU (organizational unit) is a filter within the Host setup and management > Host management page. The Host management page allows you to view and manage all the hosts in your environment that have Falcon sensors installed. You can filter the hosts by hostname, group, OS version, sensor version, last seen date, health events, detections, and preventions. You can also filter by OU, which is a logical grouping of hosts based on their Active Directory domain structure.
NEW QUESTION # 21
An inactive host that does not contact the Falcon cloud will be automatically removed from the Host Management and Trash pages after how many days?
- A. 75 Days
- B. 45 Days
- C. 60 Days
- D. 90 Days
Answer: B
Explanation:
The correct retention period is 45 days . In Falcon Host Management, a host becomes inactive when its sensor no longer sends heartbeat communication back to the CrowdStrike cloud. Inactive status is identified by the host's Last Seen timestamp, allowing administrators to determine when the endpoint last communicated.
Falcon automatically removes hosts that remain inactive for more than 45 days from both the Host Management page and the Trash page. This behavior prevents stale endpoint records from remaining indefinitely in the operational console while still giving administrators time to review, delete, restore, or investigate host records before they age out. The 60-day, 75-day, and 90-day options do not match the documented Falcon host lifecycle. This topic belongs to Host Management and Setup, specifically inactive host cleanup, deleted host handling, Trash retention, and endpoint lifecycle management.
NEW QUESTION # 22
A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?
- A. The domain controller is preventing the connection
- B. They do not have an RTR role assigned to them
- C. The host has a user logged into it
- D. There is another analyst connected into it
Answer: B
Explanation:
The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles: Real Time Response -Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response.
NEW QUESTION # 23
What is the function of a single asterisk (*) in an ML exclusion pattern?
- A. The single asterisk is the insertion point for the variable list that follows the path
- B. The single asterisk will match any number of characters, including none. It does include separator characters, such as \ or /, which separate portions of a file path
- C. The single asterisk will match any number of characters, including none. It does not include separator characters, such as \ or /, which separate portions of a file path
- D. The single asterisk is only used to start an expression, and it represents the drive letter
Answer: C
Explanation:
Reference: https://docs.microsoft.com/en-us/azure/machine-learning The asterisk is a wildcard character that can be used in exclusion patterns to match any number of characters. However, it does not match separator characters, such as \ or /, which are used to separate portions of a file path. For example, the pattern C:\Windows\*\*.exe will match any executable file in any subfolder of the Windows folder, but not in the Windows folder itself.
NEW QUESTION # 24
After attempting to uninstall the Falcon sensor from a Windows endpoint, the process appears stuck. What troubleshooting step should be taken?
- A. Force stop the sensor service in Task Manager
- B. Delete the sensor directory manually
- C. Check the CrowdStrike Windows Sensor log file for errors
- D. Reboot the system immediately
Answer: C
Explanation:
The correct troubleshooting step is to check the CrowdStrike Windows Sensor log file for errors. Falcon sensor uninstall and maintenance operations are protected processes, especially when uninstall protection or tamper protection is enabled. Force-stopping services or deleting directories manually can damage the installation, leave drivers or services in an inconsistent state, and complicate remediation. Rebooting may be necessary in some cases, but it should not be the first diagnostic action when the uninstall appears stuck. The Windows sensor deployment guidance directs administrators to review sensor logs when installation, connection, or uninstall behavior is abnormal. Logs provide the error context needed to determine whether the issue is a token, policy, service dependency, installer state, or connectivity problem.
NEW QUESTION # 25
Which setting inside the Sensor Update Policy prevents unauthorized uninstallation?
- A. Sensor Version Control Protection
- B. Uninstall and Maintenance Protection
- C. Update and Management Protection
- D. Installation and Maintenance Protection
Answer: B
NEW QUESTION # 26
Your security team is noticing that certain privacy-sensitive information such as the URL, HTTP Header and POST bodies are missing from HTTP related detections.
What is likely the cause for this?
- A. The prevention policy was configured to have an aggressive prevention setting, but only a cautious detection setting
- B. The network perimeter firewall blocked the HTTP connection attempts so there was nothing for Falcon to detect
- C. The prevention policy has been configured to redact HTTP detection details
- D. The prevention policy was never configured to generate HTTP detections
Answer: C
NEW QUESTION # 27
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?
- A. Policy alignment is configured in the General Settings section under the Configuration menu
- B. Policy alignment is configured in each policy in the "Assigned Host Groups" tab
- C. Policy alignment is configured only once during the initial creation of the policy in the "Create New Policy" pop-up window
- D. Policy alignment is configured in the "Host Management" section in the Hosts application
Answer: B
Explanation:
The alignment of a particular prevention policy to one or more host groups can be completed in each policy in the "Assigned Host Groups" tab. This tab allows the administrator to select which host groups will use the policy, as well as view the number of hosts and sensors assigned to each group. The other options are either incorrect or not available.
NEW QUESTION # 28
When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?
- A. Operating System Groups
- B. Enterprise Groups
- C. Custom IOC Groups
- D. Custom IOA Rule Groups
Answer: D
Explanation:
Prevention Policies are created based on the OS (Windows, MAC and Linux policies). Once a prevention policy is created, three options appear on top: Settings, Assigned Host Groups and Assigned Custom IOAS (tested on Crowdstrike). Therefore, Host Groups and Custom IOAS are the two different types of groups a prevention policy can be aligned to.
NEW QUESTION # 29
You are deploying the Falcon sensor to a total of 500 hosts. Hosts in an Organizational Unit (OU) will need a specific exclusion that was previously identified. This OU is expected to add members over the next quarter.
What is the best way to create a host group for this OU?
- A. Create a dynamic group with an assignment rule that excludes the OU
- B. Create a dynamic group with an assignment rule that filters for the OU
- C. Create a static group with from list of host names in the OU
- D. Create a static group with from list of all 500 host names.
Answer: B
NEW QUESTION # 30
You are deploying the Falcon sensor to 500 hosts. Hosts in an Organizational Unit need a specific exclusion that was previously identified. This OU is expected to add members over the next quarter. What is the best way to create a host group for this OU?
- A. Create a Dynamic Group targeting Windows 10 OS in the domain
- B. Create a dynamic group with an assignment rule that excludes the OU
- C. Create a dynamic group with an assignment rule that filters for the OU
Answer: C
Explanation:
The best approach is to create a dynamic group with an assignment rule that filters for the OU . Because the OU is expected to gain members over time, dynamic membership ensures that new hosts automatically enter the appropriate group when their Active Directory OU attribute matches the rule. Targeting only Windows 10 would be imprecise because it would include hosts outside the intended OU and miss non- Windows-10 systems in scope. Excluding the OU is the opposite of the requirement. CCFA group creation guidance emphasizes dynamic groups for membership that should follow changing attributes such as OU, OS version, platform, tags, or host type. This supports scalable policy and exclusion assignment without manual updates.
NEW QUESTION # 31
When using Microsoft Windows, what command verifies that a Falcon Sensor is running?
- A. sc.exe query csagent
- B. sc.exe query falcon
- C. netstat.exe -f
- D. cswindiag.exe -status
Answer: A
Explanation:
On Microsoft Windows, the supported command to verify that the Falcon Sensor is running is sc.exe query csagent. This command queries the Windows service control manager for the Falcon sensor service driver named csagent. When the sensor is running correctly, the output shows SERVICE_NAME: csagent and a running state, specifically STATE : 4 RUNNING. This is the direct operational validation method documented for Windows sensor troubleshooting. cswindiag.exe is used to collect diagnostic information, but it is not the standard command for confirming the running state of the sensor. netstat.exe -f displays network connections and DNS names, not Falcon sensor service status. sc.exe query falcon is incorrect because the Windows service name is not falcon; it is csagent. Reference topics: Windows Sensor Deployment, Verify Sensor Status, Sensor Troubleshooting, Host Setup and Management.
NEW QUESTION # 32
How can a API client secret be viewed after it has been created?
- A. Within the API management page, API client secrets can be accessed within the "edit client" functionality
- B. The API client secret must be reset or a new client created as the secret cannot be viewed after it has been created
- C. The API client secret can be provided by support via direct email request from a Falcon Administrator
- D. Selecting "show secret" within the 3-dot dropdown menu will reveal the secret for the selected api client
Answer: B
Explanation:
The way an API client secret can be viewed after it has been created is that the API client secret must be reset or a new client created as the secret cannot be viewed after it has been created.
As explained in question 137, an API client secret is only displayed once during creation for security reasons. If you lose or forget your API client secret, you cannot view it again in the Falcon console. You have two options to resolve this issue: either reset your API client secret or create a new API client. Resetting your API client secret will generate a new secret for your existing API client, which will invalidate any previous secret. Creating a new API client will generate a new API client ID and secret, which will require you to update any applications or scripts that use the Falcon APIs.
NEW QUESTION # 33
What will happen to a host that is not part of any group which has a prevention policy assigned to it?
- A. The host will send a notification to the Falcon Administrator to assign a prevention policy
- B. The host will apply a sensor-based policy to prevent a majority of known threats
- C. The host will apply the default prevention policy
- D. The host will disable the falcon sensor
Answer: C
NEW QUESTION # 34
What is the primary purpose of audit logs in Falcon?
- A. Monitor system performance
- B. Track configuration changes
- C. Trace file changes
Answer: B
Explanation:
The primary purpose of Falcon audit logs is to track configuration and administrative changes . Audit logs provide accountability by showing what changed, who made the change, and when it occurred. Examples include policy creation, updates, deletions, role changes, user management actions, IP allowlist changes, and other administrative activity. Tracing file changes is the purpose of file integrity monitoring tools such as Falcon FileVantage, not the general Falcon audit log. Monitoring system performance is handled through sensor health, host status, and operational telemetry rather than audit logs. CCFA emphasizes audit logs as an administrative governance and investigation tool that supports accountability, change review, and security operations oversight.
NEW QUESTION # 35
To improve the organization's security posture, you are designing a Fusion SOAR workflow to generate an alert when critical vulnerabilities are detected by Falcon. When creating a new workflow from scratch, what component of the workflow must be configured first?
- A. Trigger
- B. Action
- C. Condition
- D. Workflow Name
Answer: A
Explanation:
The first component configured when creating a Fusion SOAR workflow from scratch is the Trigger . Falcon workflows follow a trigger-condition-action model: the trigger determines what starts the workflow, the condition narrows execution logic, and the action defines what Falcon does after the workflow criteria are met. For a workflow involving critical vulnerabilities, the trigger is the event that initiates automation, such as Falcon detecting or receiving a vulnerability-related event. Only after the trigger is selected can the administrator add conditions, such as vulnerability severity equals Critical, and then define the action, such as generating an alert, creating a ticket, sending a notification, or initiating another response. The course guide describes this model using the exact example of critical vulnerabilities: Trigger is Falcon detecting an endpoint vulnerability, Condition is vulnerability severity of Critical, and Action is creating a ServiceNow incident. Therefore, Action and Condition are configured after the trigger, and Workflow Name is administrative metadata rather than the execution-starting component. Reference topics: Fusion SOAR workflows, trigger-condition-action model, vulnerability workflow automation.
NEW QUESTION # 36
Your incident responder team is migrating existing workflows into Fusion SOAR workflows so that they execute natively in Falcon. The workflow imports are failing. What format must the workflows be in order to successfully import them into Fusion SOAR?
- A. JSON
- B. YAML
- C. SOAR
- D. CSV
Answer: B
Explanation:
Fusion SOAR workflow imports use YAML format. YAML is commonly used for declarative workflow definitions because it is human-readable while still preserving structured configuration such as triggers, conditions, actions, branches, and parameters. CSV is a tabular format and cannot represent workflow logic reliably. JSON is structured but is not the expected import format in this context. "SOAR" is a functional category, not a file format. When workflow imports fail, administrators should validate the file structure, indentation, required fields, and supported action/trigger references in the YAML file. The CCFA workflow topic emphasizes that native Falcon automation must match the supported Fusion SOAR workflow structure to import and execute successfully.
NEW QUESTION # 37
......
Fully Updated Free Actual CrowdStrike CCFA-200b Exam Questions: https://pdftorrent.actual4test.com/CCFA-200b_examcollection.html