CCFA-200 Exam Questions and Answers

QUESTION: 11

How do you disable all detections for a host?

Create an exclusion rule and apply it to the machine or group of machines
Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
You cannot disable all detections on individual hosts as it would put them at risk
In Host Management, select the host and then choose the option to Disable Detections

Answer(s): D

Explanation:

The administrator can disable all detections for a host by selecting the host and then choosing the option to Disable Detections in the Host Management page. This will prevent the host from sending any detection events to the Falcon Cloud. The other options are either incorrect or not available.

Reference:

[CrowdStrike Falcon User Guide], page 32.

Reveal Solution Next Question

QUESTION: 12

To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
Using IOC management, import the list of hashes and IP addresses and set the action to No Action

Answer(s): A

Explanation:

IOC management only allows "Detect only" and "No Action" among the possible actions. Therefore, it cannot be used to block based on IPs or domains. Custom IOA Rule groups allow to create rule types based on Network Connection (configuring a remote IP address) and domains, and gives the options to "Monitor", "Detect" and "Kill Process", being the late one the closest to "block".

Reveal Solution Next Question

QUESTION: 13

Which role is required to manage groups and policies in Falcon?

Falcon Host Analyst
Falcon Host Administrator
Prevention Hashes Manager
Falcon Host Security Lead

Answer(s): B

Explanation:

The Falcon Host Administrator role is required to manage groups and policies in Falcon. This role allows users to create, edit and delete groups and policies, as well as assign them to hosts. The other roles do not have this capability.

Reference:

[CrowdStrike Falcon User Guide], page 17.

Reveal Solution Next Question

QUESTION: 14

Which of the following can a Falcon Administrator edit in an existing user's profile?

First or Last name
Phone number
Email address
Working groups

Answer(s): A

Explanation:

Roles are never called 'working groups' in the documentation. The only other option that can be edited on a existing user is first and last name.

Reveal Solution Next Question

QUESTION: 15

You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

Specific sensor version number
Auto - TEST-QA
Sensor version updates off
Auto - N-1

Answer(s): A

Explanation:

The administrator can choose a specific sensor version number in the Sensor Update policy to manually control when the sensor version is upgraded or downgraded. This will allow the Falcon Cloud to push out sensor version changes, but only when the administrator changes the version number in the policy. The other options will either automate the sensor version updates or turn them off completely.

Reference:

[CrowdStrike Falcon User Guide], page 38.

Reveal Solution Next Question

CrowdStrike CCFA-200 Exam (page: 3) CrowdStrike Certified Falcon Administrator Updated on: 12-Feb-2026

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

Reference:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

Reference:

CrowdStrike CCFA-200 Exam (page: 3)
CrowdStrike Certified Falcon Administrator
Updated on: 12-Feb-2026