CCFA-200B: CrowdStrike Certified Falcon Administrator

Question

The security team notices that some privacy-sensitive information—such as the URL, HTTP header, and POST bodies—is absent from HTTP-related detections.

What is the most likely cause?

Explanation

A Falcon prevention policy can enable redaction of HTTP detection details. That setting removes privacy-sensitive fields, including URLs, raw HTTP headers, and POST bodies, from HTTP detection events without preventing the detections themselves from being generated.

Learn more

CrowdStrike Developer Center — Windows Prevention Policy

CCFA-200B: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ87

Community Discussion