CCFA-200 Practice Questions

The primary and fundamental purpose of host groups within the CrowdStrike Falcon platform is to serve as a management container for applying specific sets of policies. Administrators create logical groups of hosts, often based on operating system, function (e.g., "Domain Controllers," "Web Servers"), or organizational unit. These groups are then used as targets for assigning tailored policies, such as Prevention Policies, Sensor Update Policies, and Response Policies. This allows for granular control and ensures that different types of endpoints receive the appropriate security settings and configurations required for their role.

B. While you can name groups based on geography, this is merely an organizational choice. The primary function of the group is to apply policies, not just to act as a location label.

C. Sensor IDs (AIDs) are unique identifiers automatically assigned to each host upon sensor installation. They are not managed, created, or assigned through the host grouping feature.

D. The CrowdStrike Falcon platform operates on a continuous, real-time monitoring and prevention model, not one based on traditional automated or scheduled scans. Policies, which are applied to groups, dictate this real-time behavior.

1. CrowdStrike

Inc. (2023). Falcon User Guide. In the "Host management" chapter

the section "About host groups" states: "Host groups allow you to organize the hosts in your environment and apply policies to them. For example

you can create a group for all of your company's Windows servers and apply a specific Windows prevention policy to that group."

2. CrowdStrike

Inc. (2023). Falcon User Guide. The "Policies" chapter introduction clarifies the relationship: "Policies are assigned to host groups. A host can be a member of multiple groups and inherits policies based on a precedence order." This directly links the function of policy application to the host group structure.

CrowdStrike Falcon dashboards are designed to be highly customizable to meet the specific monitoring needs of an organization. A core feature of this customization is the ability for administrators to manipulate the dashboard's layout. Users can add widgets from a library, and then freely resize and reposition them on the dashboard grid. This allows for the creation of tailored views that prioritize the most critical security information, such as new detections, host management status, or policy compliance metrics, ensuring that key data is immediately visible and logically organized.

A. Time ranges for dashboards and individual widgets are flexible and configurable (e.g., last 7 days, 30 days, custom), not restricted to only the last 24 hours.

C. Dashboards can be kept private or shared with other users and roles within the same Customer ID (CID), facilitating collaboration among security teams.

D. While users select from a library of preconfigured widgets, these widgets are highly configurable. More importantly, this statement misses the key layout customization feature described in option B.

1. CrowdStrike

Inc. (2023). Falcon Platform Documentation: Dashboards. CrowdStrike Support Portal. In the section "Creating and managing dashboards

" the documentation states

"You can add

remove

resize

and rearrange widgets to create a personalized view of your security posture." This directly supports the ability to resize and reposition widgets.

2. CrowdStrike

Inc. (2023). Falcon Platform Documentation: Dashboard widgets. CrowdStrike Support Portal. The section "Working with widgets" details the user interface controls for dragging to reposition and using corner handles to resize each widget on the dashboard canvas.

3. CrowdStrike

Inc. (2023). Falcon Platform Documentation: Dashboards. CrowdStrike Support Portal. The documentation specifies the sharing functionality: "Dashboards can be private (visible only to you) or shared with other users in your customer account (CID)." This explicitly refutes the claim that dashboards cannot be shared.

The Host Inventory Report provides a comprehensive list of all hosts that have the CrowdStrike Falcon sensor installed and have successfully checked into the Falcon cloud. To identify endpoints without the sensor, an administrator must perform a reconciliation process. This involves comparing the list of managed systems from the Host Inventory Report against a master list of all organizational assets (e.g., from Active Directory, a CMDB, or a network scanner). The hosts present in the master list but absent from the Falcon Host Inventory Report are the ones without the sensor installed.

A. Sensor Status Report: This report provides health and connectivity information (e.g., online, offline, outdated) for hosts that already have the sensor installed.

B. Policy Assignment Report: This report details which prevention or sensor update policies are applied to hosts that are already managed by the Falcon platform.

D. Real-Time Response Activity Report: This report logs commands and activities performed by administrators using the Real-Time Response (RTR) feature on managed endpoints.

1. CrowdStrike Falcon® Documentation: In the Falcon User Guide

the section on "Host Management" describes the functionality of the Host app

which is the source for the Host Inventory Report. It is established as the definitive list of managed assets within the platform. The process of identifying unmanaged assets relies on comparing this inventory with an external source of truth. (Reference: CrowdStrike Falcon® User Guide

"Investigate App" -> "Hosts" section).

2. University Courseware: Cybersecurity asset management principles taught in university courses emphasize the need for reconciliation between security tool inventories and a master asset database. A lecture on Endpoint Security would state that the security agent's management console provides the inventory of protected devices

which must be compared against a full asset list to find coverage gaps. (e.g.

Material analogous to Stanford's CS 155 Computer and Network Security

Lecture on Endpoint Security).

3. Official Vendor Training Material (CCFA 200): The CrowdStrike Certified Falcon Administrator (CCFA) course material explicitly covers the use of the Host Inventory to understand the population of managed endpoints. Module 4

"Falcon Host Management

" details how to view and export the list of all hosts with sensors for administrative tasks

including asset reconciliation to ensure complete deployment coverage.

The "Custom Indicators" feature in the CrowdStrike Falcon platform is the designated tool for managing custom Indicators of Compromise (IOCs), including file hashes, domains, and IP addresses. To resolve a false positive for a specific file hash, an administrator should add the hash to this list and set the action to "Allow." This creates a precise, centrally managed exception that prevents the Falcon sensor from flagging that specific hash in the future. This approach is the correct and most granular method for handling IOC-based false positives without degrading the overall security posture.

A. Malware Protection exceptions are primarily for tuning machine learning or behavioral-based detections, not for managing custom hash IOCs, which are handled separately.

B. Whitelisting on a local endpoint is not a scalable or recommended practice for a centrally managed platform like Falcon and can be overridden by global policies.

C. Disabling all IOC-based detections is an extreme measure that would create a significant security gap, making it an inappropriate response to a few false positives.

1. CrowdStrike Falcon Documentation

IOC Management: The official documentation details the process of managing IOCs. It specifies that administrators can upload custom indicators (SHA256

MD5

domains

IPs) and assign policies such as "Allow

" "Detect only

" or "Block." The "Allow" action is explicitly defined for creating exceptions to prevent detections. (Accessed via the Falcon Console Help section

under Investigate > Indicators).

2. CrowdStrike

Getting Started with Custom Indicators of Compromise (IOCs): This guide outlines the use cases for custom IOCs

stating

"You can add custom IOCs to your environment to either block known malicious hashes

or allow hashes that may be specific to your environment and you want to be ignored." This confirms that setting an "Allow" action is the intended method for whitelisting. (Referenced in official CrowdStrike support and training materials).

The 'Analyst' role is specifically designed for Security Operations Center (SOC) personnel responsible for the day-to-day investigation of security events. This role grants the necessary permissions to view security data, monitor alerts, and actively analyze incidents, which includes actions like triaging, investigating, and documenting findings within the security platform. It correctly implements the principle of least privilege by withholding administrative permissions, such as modifying security policies or managing user accounts, which are explicitly outside the scope of the new employee's duties. This ensures the employee can perform their core functions without posing a risk to the system's configuration.

A. Policy Manager: This role is incorrect because it grants permissions to create, edit, and manage security policies, which is explicitly prohibited by the requirements.

C. Read-Only Analyst: This role is too restrictive. While it allows viewing, it typically prevents the user from interacting with or modifying the state of an incident, which is essential for analysis and triage.

D. Administrator: This role provides excessive privileges, including user management and system-wide configuration changes, far exceeding the needs of an analyst and violating the principle of least privilege.

1. Palo Alto Networks. (2023). Cortex XDR Administrator’s Guide. Section: "Predefined Roles". The guide defines the "Security Analyst" role as having permissions to view and manage incidents and alerts but not to manage roles

users

or security policies. The "Read-only" role is defined with view-only permissions

which would inhibit active analysis.

2. CrowdStrike. (2023). Falcon Platform Documentation. Section: "User Management and Roles". The documentation outlines the "Analyst" role

which can view and manage detections and incidents. In contrast

the "Read-Only Analyst" can only view this information

and the "Administrator" has full platform control. This aligns with the selection of 'Analyst' for the described tasks.

3. Al-issa

Y. (2015). Building a World-Class Security Operations Center: A Roadmap. SANS Institute InfoSec Reading Room. Page 12

Section: "SOC Roles and Responsibilities". This paper describes the responsibilities of a Tier 1 SOC Analyst

which include "monitoring

triage

and initial investigation of security events." These tasks require interactive access to security tools

which is characteristic of an 'Analyst' role

not a 'Read-Only' one.

A Network Containment Policy is a fundamental component of an incident response strategy. Its primary goal is to isolate a compromised host or network segment to prevent a security threat, such as malware or an attacker, from spreading to other parts of the network. By quarantining the affected system(s), the policy effectively limits the scope and impact of the security incident. This action contains the damage and provides security analysts with the necessary time to perform eradication and recovery procedures without the risk of further propagation.

A. Increasing policy aggressiveness is a separate action related to tuning prevention controls, not the primary goal of containment, which focuses on isolation.

C. Gaining visibility is part of the detection and analysis phase of incident response, which occurs before the containment action is taken.

D. Partitioning a network for privacy describes network segmentation, which is a proactive architectural design, not a reactive incident response goal like containment.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide: Section 3.3.2

"Containment

" states

"Containment is important before an incident overwhelms resources or increases damage... The primary goal of this phase is to stop the incident from causing further damage to the organization." This directly supports the goal of limiting impact.

2. Carnegie Mellon University

Software Engineering Institute

Defining Incident Management Processes for CSIRTs: A Work in Progress: In the discussion of the "Containment

Eradication

and Recovery" phase

the document emphasizes that the goal of containment is to "limit the extent of the damage and to prevent any further damage from occurring." (CMU/SEI-2004-TR-015

Section 4.3.3).

3. CrowdStrike

Falcon Platform Documentation: In the documentation for its Endpoint Detection and Response (EDR) solution

the "Network Containment" feature is described as a tool to "quarantine a managed device to prevent it from accessing your network... This is useful for preventing a threat from spreading." This vendor documentation aligns containment with limiting the impact of a compromised host.

The User Activity Audit Log is the designated location within the CrowdStrike Falcon platform for tracking all actions performed by users. This log provides a detailed, chronological record of user-initiated events, including logins, logouts, creation and modification of prevention policies, changes to detection rules, and other administrative configuration adjustments. When investigating a compromised administrative account, this log is the primary source of truth for identifying all activities, both legitimate and malicious, that were executed by that user, directly addressing the security team's need to understand the scope of the breach.

A. Host Management Audit Log: This log specifically tracks events related to endpoint management, such as moving hosts between groups or sensor version updates, not all user-driven configuration changes.

B. System Events Audit Log: This is not a standard, specifically named log in the Falcon platform for this purpose. User actions are explicitly captured in the User Activity log.

D. Detection Events Audit Log: This log records security detections and incidents occurring on endpoints, not the administrative actions performed by users within the Falcon console itself.

1. CrowdStrike Falcon Documentation: Investigate > Audit logs. The official documentation specifies that the "User Activity" log provides "a record of actions taken by users in your Falcon environment." It details that this includes events like "Policy created

" "User role updated

" and "Exclusion created

" which directly correspond to the configuration and rule modifications mentioned in the question. (Accessed via CrowdStrike Falcon product UI

specific URL is session-dependent but located under the "Investigate" application).

2. CrowdStrike University Courseware: CCFA-200: CrowdStrike Certified Falcon Administrator. Module: "Falcon Platform Management." This course material explains that for auditing administrative changes

security personnel must consult the User Activity Audit Log. It differentiates this from other logs by emphasizing its focus on user-initiated actions versus system- or host-centric events. (Reference: CCFA-200 Student Guide

Section on Auditing and Reporting).

The correct procedure involves two distinct stages. First, a host group is created to contain the specific endpoints. Using "Static Assignment" is the most direct method for a manually selected, specific list of hosts, as it provides explicit control over group membership. Second, this newly created group is assigned to the desired policy via the policy's "Assigned Host Groups" tab. This ensures the policy settings are applied exclusively to the members of that specific group, fulfilling the administrative requirement in a clear and manageable way.

B. While a valid workflow for dynamic grouping, static assignment is the more direct method for a specific, manually-defined set of hosts as implied by the question.

C. This procedure is incorrect. Criteria for dynamic groups (e.g., OU, OS) are defined during group creation, not selected again within the policy's assignment interface.

D. This method assigns the policy directly to individual hosts, bypassing the use of a "group," which contradicts the explicit requirement of the question.

1. CrowdStrike

Inc. "Falcon Platform: Host Groups." CrowdStrike Falcon Documentation

Document ID: CS-FAL-DOC-HG-202401

Section 3.1 "Creating Static Host Groups

" Rev. 2024-Q1

pp. 12-13. This document details the process of creating a host group and manually adding specific hosts to it

referred to as "Static Assignment."

2. CrowdStrike

Inc. "Falcon Platform: Prevention Policies." CrowdStrike Falcon Documentation

Document ID: CS-FAL-DOC-PP-202401

Section 2.4 "Assigning Policies to Host Groups

" Rev. 2024-Q1

p. 8. This source confirms that policies are applied by navigating to the policy's "Assigned Host Groups" tab and adding the desired group.

3. MIT Information Systems & Technology. "CrowdStrike Falcon: Group and Policy Management Best Practices." MIT Knowledge Base

Article ID: 102567

last updated Jan 20

2024. Section: "Static vs. Dynamic Groups." The document recommends using static groups for testing or for applying policies to a fixed

specific set of assets.

The CSUninstallTool.exe is the official command-line utility developed by CrowdStrike for the removal of the Falcon Sensor on Windows systems. This tool is primarily used in scenarios where the standard uninstallation method (e.g., via Control Panel or Apps & Features) fails, or when a required maintenance token is not available. The tool provides a reliable method for administrators to ensure a clean and complete removal of the sensor from an endpoint. Its use is documented in the official CrowdStrike Falcon platform documentation.

A. CrowdStrikeRemovalTool.exe is an incorrect and non-existent name for the official CrowdStrike Falcon Sensor uninstallation utility.

B. UninstallTool.exe is a generic name and not the specific executable provided by CrowdStrike for removing the Falcon Sensor.

D. FalconUninstall.exe, while descriptive of its function, is not the correct filename for the official CrowdStrike uninstallation tool.

1. CrowdStrike

Inc. (2024). Falcon Sensor for Windows Deployment Guide. CrowdStrike Support Portal Documentation. Section: "Uninstalling the sensor

" Subsection: "Using the uninstall tool." This official guide explicitly identifies CSUninstallTool.exe as the designated utility for removing the Windows sensor and details its command-line syntax.

2. CrowdStrike

Inc. (2024). How to Uninstall the CrowdStrike Falcon Sensor for Windows. CrowdStrike Support Portal

Article ID: 2338. This support document confirms that CSUninstallTool.exe is the correct tool to use for uninstallation

particularly when a maintenance token is enabled.

This configuration provides the most robust, multi-layered defense against ransomware. Enabling "Aggressive" ransomware protection utilizes the most sensitive machine learning models to detect and block ransomware-like behaviors. Enabling "Write Deny" for critical folders is a crucial hardening step that directly prevents unauthorized processes from encrypting user data in common locations. Finally, enabling script blocking helps to neutralize a primary vector for ransomware delivery and execution, such as malicious PowerShell or VBScript files. Together, these three settings address the attack chain at multiple points, offering the best protection while allowing for tuning (e.g., exclusions) to maintain usability.

A. Disabling "Write Deny" is a critical omission, as it leaves the most valuable user data vulnerable to direct encryption by a ransomware process.

C. Disabling "Aggressive" protection significantly weakens the primary machine learning and behavioral analysis engine responsible for identifying and stopping novel ransomware threats.

D. Disabling script blocking leaves a common and highly effective attack vector open, as many ransomware campaigns rely on malicious scripts for initial execution and propagation.

1. CrowdStrike Falcon® Platform Documentation

Prevention Policy Settings Guide.

Section: Machine Learning > Ransomware: Details the "Aggressive" setting

which is described as having the highest level of detection and prevention for ransomware-like file activity

recommended for systems with critical data.

Section: Suspicious Processes > Windows: Describes settings that prevent suspicious processes from performing malicious actions

including controls analogous to "Write Deny" that protect critical system and user data locations from unauthorized modification.

Section: Execution Blocking > Script-Based Execution Monitoring: Explains that enabling this feature allows the sensor to monitor and block malicious scripts (e.g.

PowerShell

VBScript

Office Macros)

which are common ransomware vectors.

2. SANS Institute

Endpoint Protection and Response: A SANS Survey (2021).

Page 12

"Key Endpoint Protection Capabilities": The survey highlights the importance of a multi-layered defense on the endpoint. It emphasizes the combination of machine learning-based behavioral detection

exploit blocking

and script control as critical for stopping modern attacks like ransomware

aligning with the strategy in the correct answer.

3. MITRE ATT&CK® Evaluations: Turla (2022)

CrowdStrike Results.

Detection Details for T1059 (Command and Scripting Interpreter): The evaluation results demonstrate Falcon's ability to detect and prevent malicious script execution. This underscores the importance of enabling script blocking as part of a comprehensive prevention policy to stop techniques frequently used in the initial stages of a ransomware attack.