Most Recent CrowdStrike CCFA-200b Exam Dumps

Prepare for the CrowdStrike Certified Falcon Administrator exam with our extensive collection of questions and answers. These practice Q&A are updated according to the latest syllabus, providing you with the tools needed to review and test your knowledge.

QA4Exam focus on the latest syllabus and exam objectives, our practice Q&A are designed to help you identify key topics and solidify your understanding. By focusing on the core curriculum, These Questions & Answers helps you cover all the essential topics, ensuring you're well-prepared for every section of the exam. Each question comes with a detailed explanation, offering valuable insights and helping you to learn from your mistakes. Whether you're looking to assess your progress or dive deeper into complex topics, our updated Q&A will provide the support you need to confidently approach the CrowdStrike CCFA-200b exam and achieve success.

The questions for CCFA-200b were last updated on Apr 21, 2026.

Viewing page 1 out of 31 pages.
Viewing questions 1-5 out of 153 questions

Get All 153 Questions & Answers

Question No. 1

Which of the following tools developed by Crowdstrike is intended to help with removal of the CrowdStrike Windows Falcon Sensor?

ACrowdStrikeRemovalTool.exe

BUninstallTool.exe

CCSUninstallTool.exe

DFalconUninstall.exe

Show Answer

Correct Answer: C

The tool developed by Crowdstrike that is intended to help with removal of the CrowdStrike Windows Falcon Sensor is CSUninstallTool.exe. This tool is a command-line utility that can uninstall the Falcon sensor from a Windows system without requiring user interaction or network connectivity.The tool can also bypass the Uninstall and Maintenance Protection feature if enabled in the Sensor Update Policy2.

Question No. 2

To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

ABlocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead

BUsing IOC management, import the list of hashes and IP addresses and set the action to Detect Only

CUsing IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block

DUsing IOC management, import the list of hashes and IP addresses and set the action to No Action

Show Answer

Correct Answer: A

IOC management only allows 'Detect only' and 'No Action' among the possible actions. Therefore, it cannot be used to block based on IPs or domains. Custom IOA Rule groups allow to create rule types based on Network Connection (configuring a remote IP address) and domains, and gives the options to 'Monitor', 'Detect' and 'Kill Process', being the late one the closest to 'block'.

Question No. 3

Which of the following controls the speed in which your sensors will receive automatic sensor updates?

AMaintenance Tokens

BSensor Update Policy

CSensor Update Throttling

DChannel File Update Throttling

Show Answer

Correct Answer: C

The option that controls the speed in which your sensors will receive automatic sensor updates is Sensor Update Throttling. Sensor Update Throttling allows you to limit the number of sensors that can download a new sensor version per hour. This way, you can avoid network congestion or bandwidth issues caused by simultaneous sensor updates.You can configure the Sensor Update Throttling setting in the Sensor Update Policy for each platform1.

Question No. 4

How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

AUnder Dashboards and reports, choose the Sensor Report. Set the 'Last Seen' dropdown to 30 days and reference the Inactive Sensors widget

BUnder Host setup and management, choose the Host Management page. Set the group filter to 'Inactive Sensors'

CUnder Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days

DUnder Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

Show Answer

Correct Answer: C

The administrator can find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days by going to Host setup and management > Managed endpoints > Inactive Sensors. Then, change the time range to 30 days. This will show the host name, last seen date, sensor version and group name for each inactive host. The other options are either incorrect or not available. Reference: [CrowdStrike Falcon User Guide], page 31.

Question No. 5

Which of the following applies to Custom Blocking Prevention Policy settings?

AHashes must be entered on the Prevention Hashes page before they can be blocked via this policy

BBlocklisting applies to hashes, IP addresses, and domains

CExecutions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary

DYou can only blocklist hashes via the API

Show Answer

Correct Answer: A

Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on ''Upload Hashes'' in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon API.

https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom-blacklisting/

Unlock All Questions for CrowdStrike CCFA-200b Exam

Full Exam Access, Actual Exam Questions, Validated Answers, Anytime Anywhere, No Download Limits, No Practice Limits

Get All 153 Questions & Answers