CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Browse Mode
About the Exam

CrowdStrike certification aimed at administrators and analysts with access to the administrative side of the Falcon platform. It covers sensor deployment and health, host and host-group management, prevention and response policies, exclusions, user and role administration, and platform configuration. Passing demonstrates the ability to run and maintain a Falcon deployment day to day.

Exam Topics

  • User Management0%
  • Sensor Deployment0%
  • Host Management and Setup0%
  • Group Creation0%
  • Policy Application0%
  • Rules Configuration0%
  • Dashboards and Reports0%
  • Workflows0%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated September 14, 2026 at 7:41 AM

Topic filter
Question status
Question sort
Questions per page

QuestionQ1

VerifiedGroup Creation

You need to create a “Workstations” host group that includes ALL workstations in your environment.

Which dynamic-grouping criterion would best achieve this objective?

Explanation

The host type attribute classifies devices by their role, so a dynamic criterion of Type = Workstation automatically includes workstation hosts regardless of platform, site, or manually applied grouping tags.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

VerifiedDashboards and Reports

What is the purpose of the Machine-Learning Prevention Monitoring Audit Log?

Explanation

The Machine-Learning Prevention Monitoring Audit Log shows malicious processes that would have been blocked in the environment under different Machine-Learning Prevention settings. It supports evaluating the effect of prevention sensitivity without relying only on processes actually quarantined or blocked.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

VerifiedPolicy Application

When creating an API client, which two pieces of information must be generated together to successfully identify and validate your API integrations?

Explanation

A client ID uniquely identifies the API client, while the client secret is the confidential credential used to authenticate and validate that client.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

VerifiedSensor Deployment

Which components must be permitted to manually install Falcon Sensor on macOS?

Explanation

Manual Falcon Sensor installation on macOS requires allowing its system extension, granting Full Disk Access, and approving its network filter extension so the sensor can operate with the required endpoint visibility and network functionality.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

VerifiedWorkflows

You will test detections on your host using pentest and security tooling.

How can you create a workflow that automatically assigns to you, in real time, any detection associated with your pentest?

Explanation

An Event-triggered EPP-detection workflow can be scoped with a hostname condition so that it applies only to detections from the pentest host. This prevents unrelated EPP detections from being assigned to the tester; the matching workflow can assign those scoped detections to that user.

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home