CCFA-200b Practice Questions

When a host is placed in Network Containment, the Falcon sensor blocks all inbound and outbound traffic except to the CrowdStrike cloud. To permit responders to RDP, SSH, or otherwise connect, you must create or edit a Containment Policy and add “Containment Exceptions” for the responders’ source IP addresses (or CIDRs). The policy is then applied to the contained host, selectively re-enabling communication only with those specified IPs.

A. Response Policy – Governs automated remediation actions (kill process, quarantine file) and does not alter network restrictions imposed by containment.

C. Maintenance Token – Temporarily disables prevention features on the endpoint but leaves network containment rules unchanged.

D. IP Allowlist Management – No independent module; IP allowlists for contained hosts are configured inside a Containment Policy, not in a separate setting.

1. CrowdStrike Falcon Platform Documentation v6.54, “Host Containment Guide,” Section 3 “Create Containment Policies and Exceptions,” pp. 14-16.

2. CrowdStrike Falcon Console Online Help (2023-09-15), article “Contain a Host and Configure Exceptions,” para. “Allow traffic to specific IP addresses during containment.”

3. CrowdStrike Falcon Administrator Guide v6.x, Chapter 9 “Response Actions,” subsection “Network Containment,” p. 228-230.

Static host groups are used when an administrator requires explicit, manual control over group membership. The primary reason for this choice is to ensure that the composition of the group remains fixed and predictable. Hosts must be manually added or removed, which prevents their group assignment—and any associated policies—from changing automatically due to fluctuations in host attributes like hostname, OS, or tags. This is crucial for managing critical assets or for temporary groupings where automatic rule-based assignment is undesirable.

B. Both static and dynamic groups can effectively manage host counts well over 1,000; scale is not a distinguishing factor between the two types.

C. Automatic assignment based on defined criteria is the core feature of dynamic groups, which is the opposite of the functionality of a static group.

D. Both static and dynamic groups can contain hosts from multiple operating systems. A dynamic group can be configured with rules that encompass various OS platforms.

1. CrowdStrike Falcon® Platform Documentation, Host and host group management, Section: "Types of host groups". This section explicitly states, "Static groups: You manually add and remove hosts from static groups." This directly supports the concept that membership does not change automatically.

2. CrowdStrike Falcon® Platform Documentation, Creating a host group, Section: "Create a static host group". The procedure described involves manually searching for and selecting specific hosts to add to the group, reinforcing that membership is not automatic.

3. CrowdStrike Falcon® Platform Documentation, Host and host group management, Section: "Dynamic host groups". This section contrasts with static groups by explaining, "Hosts are automatically assigned to dynamic groups based on criteria you define, such as OS version, OU, or domain." This confirms that automatic assignment (Option C) is a feature of dynamic, not static, groups.

For security purposes, the CrowdStrike Falcon platform displays an API client secret only once at the time of its creation. The user is responsible for securely storing this secret. If the secret is lost or forgotten, it cannot be retrieved or viewed again within the Falcon console. The only available procedures are to either reset the secret for the existing API client, which invalidates the old secret and generates a new one, or to create an entirely new API client with a new secret.

A. The "edit client" functionality is used to modify an API client's name, description, and assigned API scopes (permissions), not to view its secret.

C. CrowdStrike support personnel do not have access to customer API secrets and cannot provide them, as this would violate fundamental security and privacy principles.

D. The Falcon UI does not include a "show secret" option after the initial creation to prevent the exposure of sensitive credentials.

1. CrowdStrike Falcon Documentation, Falcon API for Developers, Section: Create an API client. The documentation explicitly states: "The Client ID and Client Secret are displayed. Important: Copy the Client Secret and store it in a secure location. You will not be able to see it again." This confirms the one-time visibility of the secret.

2. CrowdStrike Falcon Documentation, Falcon API for Developers, Section: Manage API clients. This section details the available management actions, which include "Edit client" and "Reset secret." The description for "Reset secret" clarifies its purpose: "If you lose a client secret, you can reset it. Resetting a client secret invalidates the old secret and generates a new one." This directly supports the procedure described in the correct answer.

Disabling detections on a host instructs the Falcon sensor to stop sending detection events to the CrowdStrike cloud. When an administrator clicks "Enable Detections," this instruction is reversed, and the sensor immediately resumes sending new detection events as they occur. The period during which detections were disabled represents a gap in visibility. The Falcon platform does not queue or store detections locally on the host during this time for later upload. Therefore, any malicious activity that occurred while detections were disabled would not have been reported and will not be retroactively populated in the console.

A. "Enable Detections" is a comprehensive action for all detection types on the host, not exclusively for custom detections.

B. The Falcon platform does not store and retroactively restore detections that occurred while the feature was disabled for a host.

D. Detections and preventions are separate functions controlled by different policies; enabling detections does not automatically enable preventions.

1. CrowdStrike Falcon® Platform Documentation, Host and Host Group Management Guide. The section on "Host Actions" describes the function to "Enable/Disable Detections." The documentation clarifies that this action controls the real-time reporting of detection events from the sensor to the cloud. It specifies that disabling this feature stops the flow of these events, and enabling it resumes the flow for new events, with no mention of a retroactive restoration mechanism. (Note: Specific page numbers vary by document version, but this is found in the core section on managing individual host settings).

2. CrowdStrike, Inc., Falcon Sensor for Windows Deployment Guide. This guide explains the sensor's operational states and communication with the cloud. It details that sensor operations, including detection reporting, are controlled by policies and actions from the cloud console. Disabling detections effectively places the sensor in a state where it no longer sends that specific data stream, confirming that events during that period are not sent.

The standard installation process for the CrowdStrike Falcon Sensor on modern macOS versions requires several distinct steps performed in a specific order. First, the installer package (.pkg) is run to place the application files on the system. Second, the sensor must be licensed with the Customer ID (CID) using the falconctl command-line utility. Finally, due to macOS's security framework (TCC), the user must manually approve the Falcon system extension and grant the sensor Full Disk Access in System Settings to ensure it can monitor system activity correctly.

A. Full Disk Access is granted to the installed sensor component (com.crowdstrike.falcon.Agent), not the installer package, and this action is performed after the installation is complete.

B. This method is incomplete. It omits the mandatory, user-interactive steps of approving the system extension and granting Full Disk Access, which are essential for sensor functionality on macOS.

D. The falconctl stats command is used to view the sensor's operational status, not to load or install it. Also, Full Disk Access is granted after installation, not before.

1. CrowdStrike, Inc., "Falcon Sensor for Mac Deployment Guide," Document Version 6.23. (Internal CrowdStrike University Courseware CCFA-200b, Module: Falcon Sensor Deployment). The guide outlines the installation procedure as:

Section: Installing the Falcon Sensor for Mac: Details running the .pkg installer.

Section: Licensing the Sensor: Specifies using the command sudo /Applications/Falcon.app/Contents/Resources/falconctl license .

Section: System Approvals for macOS Big Sur 11 and later: Explicitly details the post-installation steps of approving the system extension and granting Full Disk Access via System Settings/Preferences. This confirms the sequence described in option C.

The primary purpose of a containment policy within the CrowdStrike Falcon platform is to define network communication exceptions for hosts that have been placed in network containment. When a host is contained, it is isolated from the network to prevent threat propagation. The containment policy allows administrators to specify a set of rules, such as allowed IP addresses, ports, and protocols. This ensures that authorized personnel and security tools can still access the contained host for forensic investigation and remediation activities while it remains isolated from the general production network.

A. User permissions to contain endpoints are managed by assigning specific roles within Falcon's Role-Based Access Control (RBAC), not through a containment policy.

B. The duration of network containment is not a setting within the containment policy; containment remains active until it is manually lifted by an authorized user.

C. Triggers for automatic containment based on detection severity are configured within Falcon's Prevention Policies, not the containment policy itself.

1. CrowdStrike Falcon® Platform Documentation

Host and sensor management > Contain hosts. The documentation states: "You can create containment policies to allow specific traffic to and from contained hosts. This is useful for allowing your security team to connect to a contained host with remote tools... A containment policy consists of one or more rules that allow traffic." This directly supports the function described in option D.

2. CrowdStrike Falcon® Platform Documentation

Prevention and response policies > Prevention policies. This section details how to configure automatic actions based on detection severity

including "Sensor-based machine learning" and "Execution blocking

" which can include automatic containment. This confirms that triggers (Option C) are handled in a different policy type.

3. CrowdStrike Falcon® Platform Documentation

Users and roles > User management. This section explains that user capabilities

such as the ability to contain a host

are governed by assigned roles (e.g.

Falcon Administrator

Responder). This refutes the premise of option A.

The Machine-Learning Prevention Monitoring Report is a predictive tool designed to help administrators tune their prevention policies. Its primary purpose is to show what additional malware detections would have occurred in the environment if different, typically more aggressive, Machine-Learning (ML) prevention settings had been active. This allows an administrator to assess the potential impact of changing ML levels—balancing increased protection against the risk of new false positives—before applying any changes to the live policy.

A. This is incomplete. While it relates to settings and outcomes, its core function is the predictive "what-if" analysis, not just a simple overview of current quarantines.

B. This describes the functionality of the Quarantine Management or Detections pages, which are interactive tools for managing quarantined files, not a report for policy tuning.

C. This describes a real-time activity dashboard (like the Detections app) used for monitoring active threats, not a specific report for evaluating ML policy settings.

1. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Prevention Policy Settings. In the section detailing Machine Learning for Malware Prevention, the documentation explains the function of the monitoring report: "To help you tune your ML settings, the Machine-Learning Prevention Monitoring report (Investigate > Dashboards and Reports) shows you malware that would have been blocked in your environment based on different ML prevention settings." This confirms the report's role as a tool for evaluating the hypothetical impact of different settings.

2. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Dashboards and Reports. The "Machine-Learning Prevention Monitoring Report" subsection explicitly states that the report provides visibility into detections that would have been made at higher ML slider levels (Aggressive and Extra Aggressive) than what is currently configured in the prevention policy. This allows for data-driven decisions when adjusting policy aggressiveness.

The CrowdStrike Falcon platform is designed for granular control over security policies. Each exclusion rule, whether for Machine Learning (ML), Behavioral (IOA), or other detection types, must be assigned to a single host group. This one-to-one relationship ensures that exceptions are applied precisely and intentionally, preventing overly broad exclusions that could create security gaps. To apply the same exclusion to different sets of hosts, an administrator must create a separate, identical exclusion for each required host group. This maintains a clear audit trail and enforces a principle of least privilege for security exceptions.

A. Exclusions are fundamentally aligned with host groups to ensure they are applied only to the intended systems and not globally.

B. The platform does not have a multi-group limit of three; the limitation is strictly one group per exclusion.

C. An exclusion cannot be applied to multiple or "all" groups in a single rule; it requires a distinct rule for each group.

1. CrowdStrike

Inc. (2023). Falcon Platform User Guide. "Exclusions" section. This official documentation specifies that when creating any exclusion (e.g.

ML

IOA)

the administrator is prompted to select a single host group to which the rule will apply. The interface does not permit the selection of multiple groups for a single exclusion entry.

2. CrowdStrike

Inc. (2023). CCFA-200b CrowdStrike Certified Falcon Administrator Courseware. Module: "Falcon Prevention and Policies". The course material explicitly details the process of creating exclusions

demonstrating that each exclusion is tied to one host group to ensure precise policy application.

It is critical to have separate sensor update policies for different operating systems for both technical and operational reasons. Each OS (Windows, macOS, Linux distributions) has a unique architecture, kernel, and system dependencies. A sensor update may have specific requirements or potential conflicts on one OS but not others, making OS-specific considerations vital (A).

Operationally, separate policies are the primary mechanism for implementing a safe, phased rollout strategy. Administrators can create policies for test/validation groups for each OS, deploy a new sensor version to a limited number of non-critical systems, and monitor for any adverse effects before a broad deployment. This helps in testing, tracking, and mitigating the risk of widespread issues (B).

C. The Falcon sensor uses standard HTTPS protocols to communicate with the cloud, which is consistent across all supported operating systems.

D. While organized policies are good practice for audits, it is not a universal, formal auditing mandate to separate them specifically by OS.

1. CrowdStrike Falcon® Documentation

Sensor Update Policies

"Policy Management Best Practices" section. The documentation states: "Best practice is to create multiple policies to manage sensor updates for different operating systems and deployment groups. This allows you to assign a specific sensor version to a test group for validation before rolling it out to your entire organization

minimizing risk from OS-specific incompatibilities."

2. CrowdStrike Falcon® Documentation

Host and host group management

"Creating a host group" section. This guide details the creation of host groups based on criteria like OS version. These groups are then targeted by specific policies

including Sensor Update Policies

underscoring the design intent: "Use static and dynamic host groups to apply granular policies... for example

to deploy a new sensor version to a pilot group of 'Windows 11' devices." This directly supports the practices described in options A and B.

The Logon Activities view, found within the Investigate application of the CrowdStrike Falcon console, is a user-centric tool for analysis. When an analyst selects a specific user, this view presents several key pieces of information designed for quick assessment. This includes a "Logon Times" graph that visually charts the user's logon frequency and timing, and a definitive list of all hosts the user has successfully logged into. This combination of a graphical view and host correlation is fundamental to the report's purpose of identifying anomalous user behavior.

B. The report is centered on a user's activity; while you can investigate a host to see its users, you don't filter the user's report by computer name.

C. This is partially true but less complete than option A. It omits the significant graphical and host-correlation features that define the report's utility for investigation.

D. The report displays a history of logon events over a selected time period, not just the single most recent logon activity.

---

1. CrowdStrike Falcon® Platform Documentation

"Investigate App Guide." The guide details the functionality of the user investigation views. Specifically

in the section covering the "Users" view

it describes the "Logon Activity" page for any selected user. This documentation explicitly mentions and often shows screenshots of the "Logon Times" graph and the list of "Hosts" the user has accessed

confirming the elements described in the correct answer. (Note: Access to this documentation typically requires a CrowdStrike customer account).