CCFA Exam Questions and Answers | Exam-Dumps (Page: 2)

QUESTION: 6

What must an admin do to reset a user's password?

From User Management, open the account details for the affected user and select "Generate New Password"
From User Management, select "Reset Password" from the three dot menu for the affected user account
From User Management, select "Update Account" and manually create a new password for the affected user account
From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid

Answer(s): B

Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group. What is the next step to disable RTR only on these hosts?

Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"

Answer(s): C

Reveal Solution Next Question

QUESTION: 8

When creating new IOCs in IOC management, which of the following fields must be configured?

Hash, Description, Filename
Hash, Action and Expiry Date
Filename, Severity and Expiry Date
Hash, Platform and Action

Answer(s): D

Reveal Solution Next Question

QUESTION: 9

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

Remediation Manager
Real Time Responder – Read Only Analyst
Falcon Analyst – Read Only
Real Time Responder – Active Responder

Answer(s): C

Reveal Solution Next Question

QUESTION: 10

One of your development teams is working on code for a new enterprise application but Falcon continually flags the execution as a detection during testing. All development work is required to be stored on a file share in a folder called "devcode." What setting can you use to reduce false positives on this file path?

USB Device Policy
Firewall Rule Group
Containment Policy
Machine Learning Exclusions

Answer(s): C

Reveal Solution Next Question

CrowdStrike CCFA Exam (page: 2)
CrowdStrike Certified Falcon Administrator
Updated on: 12-Feb-2026

QUESTION: 6

QUESTION: 7

QUESTION: 8

QUESTION: 9

QUESTION: 10

CrowdStrike CCFA Exam (page: 2) CrowdStrike Certified Falcon Administrator Updated on: 12-Feb-2026

QUESTION: 6

QUESTION: 7

QUESTION: 8

QUESTION: 9

QUESTION: 10

CrowdStrike CCFA Exam (page: 2)
CrowdStrike Certified Falcon Administrator
Updated on: 12-Feb-2026