View Full CrowdStrike CCFA-200b Exam Dumps and Practice Test Dumps.

 

Question 61

What is the primary function of CrowdStrike Falcon Spotlight?

1. Real-time vulnerability assessment and patch management tracking
2. Centralized firewall rule creation and management
3. Managing USB storage device access policies
4. Monitoring cloud-native container workloads

Correct Answer: 1

Explanation:

CrowdStrike Falcon Spotlight delivers real-time vulnerability assessment directly through the lightweight Falcon sensor without requiring active vulnerability scanning tools or intrusive network queries. It continuously analyzes operating systems and installed software applications against known Common Vulnerabilities and Exposures (CVEs), providing security teams with prioritized risk scoring and actionable visibility to remediate infrastructure vulnerabilities before exploitation occurs.

Question 62

Which component of the Falcon architecture is responsible for capturing raw kernel-level telemetry and behavioral events on an endpoint?

1. Falcon Console GUI
2. Falcon Sensor
3. Fusion SOAR Engine
4. Threat Graph Database

Correct Answer: 2

Explanation:

The Falcon sensor is an advanced, lightweight agent installed directly onto endpoints to monitor operating system activity. It operates at the kernel and user levels to capture comprehensive process creation, file modifications, network connections, and registry changes. This telemetry is processed locally and streamed to the cloud platform, forming the foundational data layer required for behavioral analysis, threat detection, and incident investigation.

Question 63

An administrator wants to ensure that specific administrative scripts are not blocked by behavioral prevention rules. Which exclusion type should be configured?

1. Machine Learning Exclusion
2. IOA (Indicator of Attack) Exclusion
3. Custom Hash Exclusion
4. Domain Exclusion

Correct Answer: 2

Explanation:

IOA (Indicator of Attack) Exclusions are specifically engineered to prevent behavioral detection rules from flagging authorized administrative scripts, deployment tools, or internal automation tasks. By specifying exact parameters like parent processes, command-line wildcards, or file execution paths, administrators can suppress false positives for legitimate custom software without compromising overall endpoint security posture or disabling underlying core protection features.

Question 64

How can an organization ensure that newly released Falcon sensor versions are thoroughly tested before rolling them out to mission-critical production servers?

1. Force global automatic updates immediately upon release
2. Assign test endpoints to a custom Sensor Update Policy configured with a specific older sensor build
3. Uninstall the sensor completely from production machines during updates
4. Disable all cloud connectivity on test workstations

Correct Answer: 2

Explanation:

Sensor update governance is best managed by creating dedicated Sensor Update Policies assigned to specific staging or pilot host groups. By pinning non-critical test systems to particular sensor builds or pilot release rings, IT and security teams can evaluate stability, verify software compatibility, and ensure operational readiness before promoting updates to wider production environments.

Question 65

What is the purpose of the Falcon UI Audit Trail?

1. To log all operating system processes executed on user workstations
2. To record administrative actions, policy changes, and user logins within the Falcon console
3. To track network bandwidth utilization across corporate routers
4. To monitor external USB flash drive connections

Correct Answer: 2

Explanation:

The Falcon UI Audit Trail captures a comprehensive chronological record of all administrative activities performed within the Falcon console. This includes tracking user logins, policy modifications, exclusions created, containment actions issued, and role changes. It provides vital accountability and governance visibility, ensuring security leadership can audit who made specific configuration changes and when those alterations occurred.

Question 66

When an endpoint is placed into Network Containment, which communication path remains active?

1. All local network shares and printer connections
2. Outbound web browsing to general public websites
3. Secure communication exclusively between the Falcon sensor and the CrowdStrike cloud
4. Remote Desktop Protocol (RDP) sessions from peer internal workstations

Correct Answer: 3

Explanation:

Network Containment isolates compromised endpoints at the driver level to stop lateral movement, worm propagation, and data exfiltration. However, to allow incident responders to investigate, retrieve forensic packages, and lift containment when remediation is complete, the sensor maintains an encrypted, dedicated communication channel strictly between the endpoint and the CrowdStrike cloud platform while blocking all other internal and external network traffic.

Question 67

Which Falcon module provides visibility into unmanaged assets, rogue devices, and IoT hardware operating on the corporate network?

1. Falcon Discover
2. Falcon Prevent
3. Falcon Insight
4. Falcon OverWatch

Correct Answer: 1

Explanation:

Falcon Discover offers comprehensive IT hygiene visibility by identifying unmanaged assets, shadow IT, rogue devices, and unsupported IoT hardware connected to the corporate network. By leveraging network traffic telemetry and peer observation from protected endpoints, Discover highlights blind spots, ensures comprehensive coverage tracking, and helps security teams enforce agent deployment across all active organizational systems.

Question 68

What action does a custom Hash Exclusion perform in a Falcon Prevention Policy?

1. It blocks all network connections associated with a specific IP address
2. It prevents the Falcon sensor from detecting, blocking, or terminating a specific file identified by its cryptographic hash
3. It forces the endpoint to reboot immediately upon file execution
4. It automatically quarantines all files matching a specified file extension

Correct Answer: 2

Explanation:

A custom Hash Exclusion instructs the Falcon sensor to bypass detection and prevention controls for a specific file based on its unique cryptographic hash (such as SHA-256). This is useful when an internal proprietary tool or specialized legacy utility is flagged as a false positive, allowing the trusted binary to execute freely across endpoints without triggering alerts or automated blocks.

Question 69

Where can administrators review details regarding automated remediation tasks and playbook execution results in Falcon Fusion?

1. Workflow Execution Log
2. Device Control History
3. Sensor Download Repository
4. API Client Management

Correct Answer: 1

Explanation:

The Workflow Execution log within Falcon Fusion provides administrators with complete visibility into automated SOAR playbooks. It displays historical run data, execution timestamps, trigger sources, condition evaluations, and output results for every automated action. Reviewing this log is essential when debugging playbook errors, verifying notification delivery, or auditing automated response actions taken during security incidents.

Question 70

What is the recommended method for deploying the Falcon sensor across hundreds of Windows machines simultaneously using enterprise software management tools?

1. Manual graphical installation by logging into each physical machine individually
2. Using command-line deployment scripts integrated with the mandatory CID parameter via SCCM, Intune, or Group Policy
3. Mailing physical USB installation drives to all remote employees
4. Copying the installer executable into public Windows shared folders

Correct Answer: 2

Explanation:

Enterprise-scale deployments rely on centralized endpoint management tools like Microsoft Intune, SCCM, or Active Directory Group Policy. Administrators package the sensor installer alongside the mandatory CID parameter and optional installation switches (NO_START, installation tokens, etc.) to automate silent, mass rollouts across thousands of endpoints efficiently without manual administrative touchpoints.

Question 71

Which CrowdStrike service provides managed threat hunting powered by human experts analyzing complex adversary behaviors 24/7?

1. Falcon OverWatch
2. Falcon Spotlight
3. Falcon Horizon
4. Falcon FileVantage

Correct Answer: 1

Explanation:

Falcon OverWatch is CrowdStrike’s managed threat hunting service. It pairs industry-leading threat intelligence with elite human threat hunters who continuously analyze subtle, stealthy behavioral patterns and complex adversary techniques across global telemetry streams. OverWatch proactively hunts down sophisticated intrusions that automated defenses might miss, alerting organizations to advanced persistent threats in real time.

Question 72

What is the primary function of Falcon FileVantage?

1. Real-time file integrity monitoring (FIM) for compliance and change tracking
2. Automated local file compression and backup management
3. Cloud storage bucket configuration security
4. Network bandwidth throttling for large file transfers

Correct Answer: 1

Explanation:

Falcon FileVantage provides robust file integrity monitoring (FIM) capabilities across enterprise endpoints. It tracks, audits, and alerts on unauthorized or unexpected modifications, creations, and deletions of critical system files, configuration settings, and registry keys. FileVantage helps organizations meet strict regulatory compliance frameworks while quickly identifying unauthorized system tampering or zero-day persistence mechanisms.

Question 73

How does the Falcon sensor handle events when it reaches its local storage caching limit during prolonged offline states?

1. It shuts down the operating system to prevent data loss
2. It overwrites the oldest cached events using a rolling buffer mechanism
3. It deletes all prevention policies and disables security controls
4. It halts all endpoint processing until internet connection is restored

Correct Answer: 2

Explanation:

When an endpoint remains offline for an extended period, the Falcon sensor stores telemetry in a secure local disk cache managed via a rolling ring buffer. If storage capacity limits are approached during prolonged isolation, the sensor intelligently overwrites the oldest cached telemetry entries to ensure continuous recording of high-priority security events and active system telemetry without destabilizing the local host filesystem.

Question 74

Which role is required in the Falcon console to create, modify, and assign Prevention and Response Policies?

1. Falcon Administrator or Security Lead with appropriate policy permissions
2. Security Investigator (Read Only)
3. Real Time Responder – Read Only Analyst
4. IT Helpdesk Technician

Correct Answer: 1

Explanation:

Managing security policies—including Prevention, Response, and Sensor Update configurations—requires elevated administrative privileges within the Falcon console, typically held by Falcon Administrators or specialized Security Leads. This ensures that sensitive security postures, block settings, and containment rules cannot be altered by unauthorized users or standard read-only analysts.

Question 75

What is the purpose of configuring API Clients and Keys in the Falcon console?

1. To allow external applications, SIEM tools, and automation scripts to securely authenticate and query the Falcon APIs
2. To generate user login passwords for corporate email systems
3. To encrypt local user hard drives during installation
4. To update local Wi-Fi router firmware automatically

Correct Answer: 1

Explanation:

API Clients and Keys enable authorized external applications, security information and event management (SIEM) platforms, orchestration tools, and custom scripts to authenticate securely with CrowdStrike Falcon APIs. By assigning specific OAuth scopes and permissions to each client ID and secret pair, administrators ensure that external integrations maintain the principle of least privilege while programmatically pulling telemetry and managing platform data.

Question 76

What function does Falcon Horizon perform within the CrowdStrike ecosystem?

1. Cloud Security Posture Management (CSPM) for multi-cloud environments
2. Endpoint USB device control and auditing
3. Automated Windows patch deployment tracking
4. Local application inventory discovery

Correct Answer: 1

Explanation:

Falcon Horizon provides Cloud Security Posture Management (CSPM) across major cloud service providers (such as AWS, Azure, and GCP). It continuously monitors cloud resource configurations, identifies misconfigurations, detects compliance violations, and uncovers infrastructure vulnerabilities, helping security teams maintain a secure cloud posture and prevent unauthorized data exposure in complex multi-cloud environments.

Question 77

What is the significance of the AID (Agent ID) during a Real Time Response (RTR) session?

1. It identifies the cryptographic license key of the software vendor
2. It uniquely identifies the target endpoint session for command execution and data retrieval
3. It establishes the administrative password required to log into Windows
4. It sets the maximum CPU throttling threshold for the sensor

Correct Answer: 2

Explanation:

The Agent ID (AID) serves as the primary unique identifier for every endpoint registered within the Falcon platform. When an analyst initiates a Real Time Response (RTR) session, the platform uses the target host’s AID to route commands, establish secure interactive communication channels, execute diagnostic scripts, and retrieve requested forensic files precisely from that specific machine.

Question 78

Which prevention setting protects against credential dumping tools that attempt to extract passwords from Windows LSASS memory?

1. Credential Theft prevention / Mimikatz protection mechanisms
2. USB Device Control blocking
3. Firewall Inbound Port Blocking
4. Network Share Containment

Correct Answer: 1

Explanation:

Falcon Prevent includes advanced behavioral protections designed specifically to detect and block credential dumping techniques, such as attacks utilizing Mimikatz against the Local Security Authority Subsystem Service (LSASS) memory. By intercepting unauthorized memory read requests and suspicious process injections, the sensor prevents attackers from harvesting active user credentials for lateral movement.

Question 79

How can security analysts quickly pivot from an individual detection event to view all related activities performed by that same process across the enterprise?

1. By running a manual command-line ping test
2. By utilizing Event Search or Threat Graph hunting queries focused on the process hash or filename
3. By uninstalling and reinstalling the local sensor
4. By modifying the global Sensor Update Policy

Correct Answer: 2

Explanation:

When investigating an alert, analysts can leverage Event Search and Threat Graph hunting capabilities to pivot instantly on IOCs, process hashes, or filenames. This allows them to trace execution history, identify parent-child relationships, uncover lateral spread across other endpoints, and determine the full scope of an intrusion campaign within seconds.

Question 80

What is the recommended operational workflow when a legitimate business application is mistakenly blocked by Falcon Prevent?

1. Permanently disable all prevention policies globally across the entire enterprise
2. Analyze the detection details in the console, verify legitimacy, and create a targeted exclusion (such as a Hash or ML exclusion)
3. Uninstall the Falcon sensor from all company computers immediately
4. Ignore the alert and tell users to bypass the error message locally

Correct Answer: 2

Explanation:

When a false positive occurs, security best practices dictate reviewing the detection details, confirming the file’s legitimacy and digital signature, and implementing a precise, targeted exclusion (such as a Machine Learning exclusion or Hash exemption). This restores operational capability for the business application without compromising enterprise security or weakening overall endpoint protection policies.