CCFA-200 Exam Questions and Answers

QUESTION: 16

What is the goal of a Network Containment Policy?

Increase the aggressiveness of the assigned prevention policy
Limit the impact of a compromised host on the network
Gain more visibility into network activities
Partition a network for privacy

Answer(s): B

Explanation:

The goal of a Network Containment Policy is to limit the impact of a compromised host on the network. This policy allows users to isolate a host from the network, while still allowing it to communicate with the Falcon Cloud and other essential services. This can help prevent further damage or data exfiltration from a compromised host. The other options are either incorrect or not related to the policy.

Reference:

[CrowdStrike Falcon User Guide], page 40.

Reveal Solution Next Question

QUESTION: 17

Which of the following applies to Custom Blocking Prevention Policy settings?

Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
Blocklisting applies to hashes, IP addresses, and domains
Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
You can only blocklist hashes via the API

Answer(s): A

Explanation:

Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on "Upload Hashes" in the upper right- hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon® API.
https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom-blacklisting/

Reveal Solution Next Question

QUESTION: 18

How many "Auto" sensor version update options are available for Windows Sensor Update Policies?

1
2
0
3

Answer(s): D

Explanation:

There are three "Auto" sensor version update options available for Windows Sensor Update Policies:
Auto - N-1, Auto - TEST-QA and Auto - Latest. These options allow the administrator to automatically update the sensor version to the previous stable version, the latest test version or the latest stable version, respectively.

Reference:

[CrowdStrike Falcon User Guide], page 38.

Reveal Solution Next Question

QUESTION: 19

The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?

Policy alignment is configured in the "Host Management" section in the Hosts application
Policy alignment is configured only once during the initial creation of the policy in the "Create New Policy" pop-up window
Policy alignment is configured in the General Settings section under the Configuration menu
Policy alignment is configured in each policy in the "Assigned Host Groups" tab

Answer(s): D

Explanation:

The alignment of a particular prevention policy to one or more host groups can be completed in each policy in the "Assigned Host Groups" tab. This tab allows the administrator to select which host groups will use the policy, as well as view the number of hosts and sensors assigned to each group. The other options are either incorrect or not available.

Reference:

[CrowdStrike Falcon User Guide], page 34.

Reveal Solution Next Question

QUESTION: 20

How long are detection events kept in Falcon?

Detection events are kept for 90 days
Detections events are kept for your subscribed data retention period
Detection events are kept for 7 days
Detection events are kept for 30 days

Answer(s): A

Explanation:

" Data is only available in the Falcon UI for investigations, etc. through the company's data retention time frame; detection information is kept for 90 days regardless; UI audits are available for 1 year

Reveal Solution Next Question

CrowdStrike CCFA-200 Exam (page: 4) CrowdStrike Certified Falcon Administrator Updated on: 12-Feb-2026

QUESTION: 16

Explanation:

Reference:

QUESTION: 17

Explanation:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation:

CrowdStrike CCFA-200 Exam (page: 4)
CrowdStrike Certified Falcon Administrator
Updated on: 12-Feb-2026