CrowdStrike CCFA-200 Deluxe Study Guide with Online Test Engine [Q24-Q40]

admin CCFA-200 CrowdStrike August 26, 2025

4/5 - (1 vote)

CrowdStrike CCFA-200 Deluxe Study Guide with Online Test Engine

CCFA-200 dumps review – Professional Quiz Study Materials

NO.24 You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?

Detection slider: Extra Aggressive
Prevention slider: Cautious

Detection slider: Moderate
Prevention slider: Disabled

Detection slider: Cautious
Prevention slider: Cautious

Detection slider: Disabled
Prevention slider: Disabled

NO.25 What are custom alerts based on?

Custom workflows

Custom event based triggers

Predefined alert templates

User defined Splunk queries

NO.26 What is the primary purpose of using glob syntax in an exclusion?

To specify a Domain be excluded from detections

To specify exclusion patterns to easily exclude files and folders and extensions from detections

To specify exclusion patterns to easily add files and folders and extensions to be prevented

To specify a network share be excluded from detections

NO.27 What is the goal of a Network Containment Policy?

Increase the aggressiveness of the assigned prevention policy

Limit the impact of a compromised host on the network

Gain more visibility into network activities

Partition a network for privacy

NO.28 Which of the following applies to Custom Blocking Prevention Policy settings?

Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy

Blocklisting applies to hashes, IP addresses, and domains

Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary

You can only blocklist hashes via the API

NO.29 You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?

Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an “Execution Prevention” rule to prevent these processes from running

Using Custom Alerts in the Investigate App, create a new alert using the template “Process Execution” and within that rule, select the option to “Block Execution”

Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to “Block” and ensure that the prevention policy these computers are using includes the option for “Custom Blocking” under Execution Blocking.

Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to “Never Allow”

NO.30 Which role will allow someone to manage quarantine files?

Falcon Security Lead

Detections Exceptions Manager

Falcon Analyst – Read Only

Endpoint Manager

NO.31 When creating a Host Group for all Workstations in an environment, what is the best method to ensure all workstation hosts are added to the group?

Create a Dynamic Group with Type=Workstation Assignment

Create a Dynamic Group and Import All Workstations

Create a Static Group and Import all Workstations

Create a Static Group with Type=Workstation Assignment

NO.32 How do you find a list of inactive sensors?

The Falcon platform does not provide reporting for inactive sensors

A sensor is always considered active until removed by an Administrator

Run the Inactive Sensor Report in the Host setup and management option

Run the Sensor Aging Report within the Investigate option

NO.33 Which role allows a user to connect to hosts using Real-Time Response?

Endpoint Manager

Falcon Administrator

Real Time Responder – Active Responder

Prevention Hashes Manager

NO.34 How do you assign a Prevention policy to one or more hosts?

Create a new policy and assign it directly to those hosts on the Host Management page

Modify the users roles on the User Management page

Ensure the hosts are in a group and assign that group to a custom Prevention policy

Create a new policy and assign it directly to those hosts on the Prevention policy page

NO.35 After agent installation, an agent opens a permanent___connection over port 443 and keeps that connection open until the endpoint is turned off or the network connection is terminated.

SSH

TLS

HTTP

TCP

NO.36 What is likely the reason your Windows host would be in Reduced Functionality Mode (RFM)?

Microsoft updates altering the kernel

The host lost internet connectivity

A misconfiguration in your prevention policy for the host

A Sensor Update Policy was misconfigured

NO.37 Where can you find your company’s Customer ID (CID)?

The CID is a secret key used for Falcon communication and is never shared with the customer

The CID is only available by calling support

The CID is located at Hosts setup and management > Deploy > Sensor Downloads and is listed along with the checksum

The CID is located at Hosts > Host Management

NO.38 Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

Remediation Manager

Real Time Responder – Read Only Analyst

Falcon Analyst – Read Only

Real Time Responder – Active Responder

NO.39 Even though you are a Falcon Administrator, you discover you are unable to use the “Connect to Host” feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?

Real Time Responder

Endpoint Manager

Falcon Investigator

Remediation Manager

NO.40 On a Windows host, what is the best command to determine if the sensor is currently running?

sc query csagent

netstat -a

This cannot be accomplished with a command

ping falcon.crowdstrike.com