CrowdStrike Certified Falcon Administrator CCFA-200 Exam Questions in PDF

Free CrowdStrike CCFA-200 Dumps Questions (page: 28)

You are attempting to install the Falcon sensor on a host with a slow Internet connection and the installation fails after 20 minutes.
Which of the following parameters can be used to override the 20- minute default provisioning window?

  1. ExtendedWindow=1
  2. Timeout=0
  3. ProvNoWait=1
  4. Timeout=30

Answer(s): C

Explanation:

"ProvNoWait=1
The sensor does not abort installation if it can't connect to the CrowdStrike cloud within 20 minutes (10 minutes, in Falcon sensor version 6.21 and earlier). (By default, if the host can't contact our cloud, it will retry the connection for 20 minutes. After that, the host will automatically uninstall its sensor.)"

"ProvWaitTime=3600000
The sensor waits for 1 hour to connect to the CrowdStrike cloud when installing (the default is 20 minutes)."



How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

  1. Under Dashboards and reports, choose the Sensor Report. Set the "Last Seen" dropdown to 30 days and reference the Inactive Sensors widget
  2. Under Host setup and management, choose the Host Management page. Set the group filter to "Inactive Sensors"
  3. Under Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days
  4. Under Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

Answer(s): C

Explanation:

The administrator can find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days by going to Host setup and management > Managed endpoints > Inactive Sensors. Then, change the time range to 30 days. This will show the host name, last seen date, sensor version and group name for each inactive host. The other options are either incorrect or not available.


Reference:

[CrowdStrike Falcon User Guide], page 31.



In order to quarantine files on the host, what prevention policy settings must be enabled?

  1. Malware Protection and Custom Execution Blocking must be enabled
  2. Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" must be enabled
  3. Malware Protection and Windows Anti-Malware Execution Blocking must be enabled
  4. Behavior-Based Threat Prevention sliders and Advanced Remediation Actions must be enabled

Answer(s): B

Explanation:

In order to quarantine files on the host, the administrator must enable the Next-Gen Antivirus Prevention sliders and "Quarantine & Security Center Registration" in the prevention policy settings. This will allow Falcon to quarantine malicious files and register them with Windows Security Center. The other options are either incorrect or not sufficient to enable quarantine.


Reference:

[CrowdStrike Falcon User Guide], page 36.



Why is it critical to have separate sensor update policies for Windows/Mac/*nix?

  1. There may be special considerations for each OS
  2. To assist with testing and tracking sensor rollouts
  3. The network protocols are different for each host OS
  4. It is an auditing requirement

Answer(s): A

Explanation:

https://www.crowdstrike.com/blog/tech-center/how-to-manage-policies-in-falcon/



How do you assign a policy to a specific group of hosts?

  1. Create a group containing the desired hosts using "Static Assignment." Go to the Assigned Host Groups tab of the desired policy and dick "Add groups to policy." Select the desired Group(s).
  2. Assign a tag to the desired hosts in Host Management. Create a group with an assignment rule based on that tag. Go to the Assignment tab of the desired policy and click "Add Groups to Policy."
    Select the desired Group(s).
  3. Create a group containing the desired hosts using "Dynamic Assignment." Go to the Assigned Host Groups tab of the desired policy and select criteria such as OU, OS, Hostname pattern, etc.
  4. On the Assignment tab of the desired policy, select "Static" assignment. From the next window, select the desired hosts (using fitters if needed) and click Add.

Answer(s): A

Explanation:

The administrator can assign a policy to a specific group of hosts by creating a group containing the desired hosts using "Static Assignment." Then, go to the Assigned Host Groups tab of the desired policy and click "Add groups to policy." Select the desired Group(s). This will apply the policy to the selected group(s) of hosts. The other options are either incorrect or not applicable to static assignment.


Reference:

[CrowdStrike Falcon User Guide], page 33.



Share your comments for CrowdStrike CCFA-200 exam with other users:

R
Rahul
8/8/2023 9:40:00 PM

i need the pdf, please.

C
CW
7/11/2023 2:51:00 PM

a good source for exam preparation

A
Anchal
10/23/2023 4:01:00 PM

nice questions

J
J Nunes
9/29/2023 8:19:00 AM

i need ielts general training audio guide questions

A
Ananya
9/14/2023 5:16:00 AM

please make this content available

S
Swathi
6/4/2023 2:18:00 PM

content is good

L
Leo
7/29/2023 8:45:00 AM

latest dumps please

L
Laolu
2/15/2023 11:04:00 PM

aside from pdf the test engine software is helpful. the interface is user-friendly and intuitive, making it easy to navigate and find the questions.

Z
Zaynik
9/17/2023 5:36:00 AM

questions and options are correct, but the answers are wrong sometimes. so please check twice or refer some other platform for the right answer

M
Massam
6/11/2022 5:55:00 PM

90% of questions was there but i failed the exam, i marked the answers as per the guide but looks like they are not accurate , if not i would have passed the exam given that i saw about 45 of 50 questions from dump

A
Anonymous
12/27/2023 12:47:00 AM

answer to this question "what administrative safeguards should be implemented to protect the collected data while in use by manasa and her product management team? " it should be (c) for the following reasons: this administrative safeguard involves controlling access to collected data by ensuring that only individuals who need the data for their job responsibilities have access to it. this helps minimize the risk of unauthorized access and potential misuse of sensitive information. while other options such as (a) documenting data flows and (b) conducting a privacy impact assessment (pia) are important steps in data protection, implementing a "need to know" access policy directly addresses the issue of protecting data while in use by limiting access to those who require it for legitimate purposes. (d) is not directly related to safeguarding data during use; it focuses on data transfers and location.

J
Japles
5/23/2023 9:46:00 PM

password lockout being the correct answer for question 37 does not make sense. it should be geofencing.

F
Faritha
8/10/2023 6:00:00 PM

for question 4, the righr answer is :recover automatically from failures

A
Anonymous
9/14/2023 4:27:00 AM

question number 4s answer is 3, option c. i

P
p das
12/7/2023 11:41:00 PM

very good questions

A
Anna
1/5/2024 1:12:00 AM

i am confused about the answers to the questions. are the answers correct?

B
Bhavya
9/13/2023 10:15:00 AM

very usefull

R
Rahul Kumar
8/31/2023 12:30:00 PM

need certification.

D
Diran Ole
9/17/2023 5:15:00 PM

great exam prep

V
Venkata Subbarao Bandaru
6/24/2023 8:45:00 AM

i require dump

D
D
7/15/2023 1:38:00 AM

good morning, could you please upload this exam again,

A
Ann
9/15/2023 5:39:00 PM

hi can you please upload the dumps for sap contingent module. thanks

S
Sridhar
1/16/2024 9:19:00 PM

good questions

S
Summer
10/4/2023 9:57:00 PM

looking forward to the real exam

V
vv
12/2/2023 2:45:00 PM

good ones for exam preparation

D
Danny Zas
9/15/2023 4:45:00 AM

this is a good experience

S
SM 1211
10/12/2023 10:06:00 PM

hi everyone

A
A
10/2/2023 6:08:00 PM

waiting for the dump. please upload.

A
Anonymous
7/16/2023 11:05:00 AM

upload cks exam questions

J
Johan
12/13/2023 8:16:00 AM

awesome training material

P
PC
7/28/2023 3:49:00 PM

where is dump

Y
YoloStar Yoloing
10/22/2023 9:58:00 PM

q. 289 - the correct answer should be b not d, since the question asks for the most secure way to provide access to a s3 bucket (a single one), and by principle of the least privilege you should not be giving access to all buckets.

Z
Zelalem Nega
5/14/2023 12:45:00 PM

please i need if possible h12-831,

U
unknown-R
11/23/2023 7:36:00 AM

good collection of questions and solution for pl500 certification

AI Tutor 👋 I’m here to help!