Is the CCFA-200B practice exam free?

Yes. ExamCademy offers all 60 CCFA-200B practice questions for free with a registered account. No payment needed. Optional supporter features add AI explanations and spaced repetition study tools.

How accurate are the CCFA-200B practice questions?

All CCFA-200B questions are community-created and reviewed by moderators to align with CrowdStrike's published exam objectives. The community continuously reports and fixes issues to keep content accurate and up to date.

How should I study for the CCFA-200B exam?

Start by browsing practice questions to identify weak areas. Use spaced repetition (Learn Mode) to focus study time on topics you struggle with. Combine practice questions with official CrowdStrike documentation and hands-on experience for best results.

CCFA-200B Practice Exam — Free 60+ Questions

60Practice Questions

3Study Modes

FreeTo Get Started

Topic:Sort:

Question 1

Policy Application

Question 2

User Management

Question 3

Host Management and Setup

Question 4

Group Creation

Question 5

Workflows

Question 6

User Management

Question 7

Rules Configuration

Question 8

User Management

Question 9

Sensor Deployment

Question 10

Dashboards and Reports

Question 11

Workflows

Question 12

Dashboards and Reports

Question 13

Dashboards and Reports

Question 14

Policy Application

Question 15

User Management

Question 16

Sensor Deployment

Question 17

Host Management and Setup

Question 18

Policy Application

Question 19

Rules Configuration

Question 20

Host Management and Setup

Question 21

Dashboards and Reports

Question 22

Policy Application

Question 23

Dashboards and Reports

Question 24

User Management

That's the end of the Preview

This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

User ManagementSensor DeploymentHost Management and SetupGroup CreationPolicy ApplicationRules ConfigurationDashboards and ReportsWorkflows

Log In / Sign Up

Page 1 of 3 • Questions 1-25 of 60

1 2 3

→

Know a question that should be here? Contribute to this exam

What prevention policy setting prevents sensor-related files, folders, and registry objects from being renamed or deleted?

A Host Modification Protection
B System Configuration Protection
C Sensor Tampering Protection
D Sensor Modification Protection

A member of your SECOPS team is building custom scripts for RTR, but they are unable to save or share them in Falcon.
What additional role do they need to be able accomplish this?

A Real Time Response – Active Responder
B Real Time Response – Administrator
C All Real Time Response roles can do this
D Falcon Scripts Manager

What happens to detections in the console after clicking “Disable Detections” for a host from within the Host Management page?

A The detections for the host are removed from the console immediately. No new detections will display in the console going forward.
B Detections from the host are paused for 7 days. Existing detections from the host are removed from the console within 24 hours.
C Existing detections for the host remain. No new detections will display in the console going forward.
D Existing detections for the host are removed from the console. The process that triggered them is allow-listed to prevent future alerts. Detections for other alerts are unaffected.

You are tasked with creating a group for hosts running Windows 10.
What kind of group should you create to make sure all applicable hosts are included in your environment?

A Create a static group with the assignment rule criteria set to OS Type Workstation
B Create a dynamic group with the assignment rule criteria set to OS Type Workstation
C Create a static group with the assignment rule criteria for OS Version set to Windows 10
D Create a dynamic group with the assignment rule criteria for OS Version set to Windows 10

To improve the organization’s security posture, you are designing a Fusion SOAR workflow to generate an alert when critical vulnerabilities are detected by Falcon.
When creating a new workflow from scratch, what component of the workflow must be configured first?

A Action
B Trigger
C Condition
D Workflow Name

Which statement best describes user permissions in Falcon?

A Custom user role permission sets can be shared with all CrowdStrike customers globally
B Users can only have predefined default roles assigned to them before using a custom role
C User permissions can be defined by default or custom roles as needed
D Each Falcon permission needs to be selected when the user account is created

When would the No Action option be assigned to a hash in IOC Management?

A When you want to save the indicator for later action, but do not want to block or allow it at this time
B There is no such option as No Action available in the Falcon console
C When you want to add the indicator to your allowlist, but not detect it
D When you want to add the indicator to your blocklist and show it as a detection

Which role allows management of quarantined files?

A Falcon Analyst – Read Only
B Detections Exceptions Manager
C Falcon Security Lead
D Endpoint Manager

When installing the Falcon Sensor manually on Microsoft Windows, where is the installation log data stored?

A %LOCALAPPDATA%\Temp
B %SYSTEMROOT%\Temp
C %SYSTEMROOT%\Logs
D %LOCALAPPDATA%\Logs

Where can you find a list of hosts that have not communicated with the CrowdStrike Cloud?

A Inactive Sensors
B Disabled Sensors
C Sensor Report
D Custom Reports

Where can you find the history of the successes and failures for any Fusion SOAR workflows?

A Falcon UI Audit Trail
B Custom Alert History
C Workflow Audit log
D Workflow Execution log

What is the purpose of the Machine-Learning Prevention Monitoring Audit Log?

A It is the dashboard used by an analyst to view all items quarantined and to release any items deemed non-malicious
B It is the dashboard used to see machine-learning preventions, and it is used to identify spikes in activity and possible targeted attacks
C It is designed to show malicious processes that would have been blocked in your environment based on different Machine-Learning Prevention settings
D It is designed to give an administrator a quick overview of machine-learning aggressiveness settings as well as the numbers of items actually quarantined

What provides information about inactive sensors within the Falcon console?

A Sensor Update Policies
B Sensor Downloads
C Sensor Health
D Sensor Coverage Lookup

What best describes the relationship between Sensor Update policies and Operating Systems?

A A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
B Sensor Update polices are not Operating System specific; one policy can be applied to all Operating Systems
C Windows has its own Sensor Update polices; Mac and Linux share Sensor Update policies
D Windows and Mac share Sensor Update policies; Linux requires its own set of polices based on the different kernel versions

When an API client is created, what two pieces of information must be generated as a pair to successfully identify and validate your API integrations?

A Customer ID and Integration ID
B Client ID and Secret
C Customer ID and Secret
D Client ID and OAuth2 ID

What is the primary concern with Windows sensors going into Reduced Functionality Mode (RFM)?

A The operating systems on these hosts have crashed
B The hosts have been powered off or otherwise cannot communicate with the Falcon cloud
C The sensors do not have full visibility into all events occurring on the host
D The sensors are unable to report any of their recorded events

How can you search for multiple hostnames at the same time via Host Management?

A Enter the multiple hostnames in the Hostname filter separating each by a comma
B Add the Hostname filter multiple times and enter separate hostnames into each filter
C Enter the multiple hostnames in the Hostname filter separating each by a decimal
D Add the Multiple Hostnames filter and enter your list of hostnames

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group.
What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

A The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers
B The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers
C The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy
D The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

Detections related to a penetration test on a particular server are currently generating thousands of entries in the console. Your leadership does not need to track the detections in Falcon.
What should you do to allow your team to focus on more relevant detections?

A Delete the detections in the console and contain the server undergoing the test
B Temporarily disable detections for the server in Host Management and reenable after the test is done
C Create a Fusion Workflow to email the SOC team every time the penetration test generates a detection
D Permanently disable detections for the server in Host Management

From the Host management page, what is the best field to filter by for Domain Controllers to obtain sensor version information?

A Sensor Version
B Type
C Platform
D OS Version

Where can you find hosts that have been offline for ten minutes or longer?

A Host Management
B Host Groups
C Sensor Report
D Sensor Coverage Dashboard

After successfully installing Falcon on a new employee’s laptop, you notice that the machine is assigned the default prevention policy instead of the custom prevention policy you created. You verify that the Falcon sensor is functioning properly, and you confirm that the custom policy is enabled and successfully running on more than 1,000 other Falcon hosts.
What is the likely cause of this issue?

A Falcon requires a 24-hour waiting period to apply custom policies to newly installed hosts
B A host-based firewall rule is preventing the custom policy from applying successfully
C The laptop is not a member of a host group assigned to the custom policy
D A prompt to apply the new prevention policy was manually declined

What log would you use to investigate unusual activity involved with a script interfacing with the Falcon platform?

A API audit
B Falcon UI audit
C Prevention policy debug
D RTR session audit

Which role allows a Falcon user to create Real Time Response Custom Scripts?

A Real Time Responder – Active Responder
B Real Time Responder – Administrator
C Real Time Responder – Read Only Analyst
D Real Time Responder – Script Developer

CCFA-200BPreview

About the CCFA-200B Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

That's the end of the Preview

CCFA-200BPreview

About the CCFA-200B Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

That's the end of the Preview