CCFA: CrowdStrike Certified Falcon AdministratorDemo

The Inactive Sensors view under Host setup and management > Managed endpoints lists hosts by their lack of communication with the CrowdStrike Cloud. Setting its time range to 30 days identifies the hosts that have been inactive for that period.

The Default Sensor Update policy is the catch-all policy: hosts that are not assigned a specific Sensor Update policy inherit its settings. It is enabled by default and includes uninstall and maintenance protection.

A containment policy defines the IP addresses that hosts in Network Containment are allowed to communicate with, preserving only approved network access while the host is isolated.

Manual Falcon Sensor installation on macOS includes installing the package, licensing the sensor with falconctl, approving the system extension required by macOS, and granting the sensor Full Disk Access so it can provide the required endpoint protection functionality.

Falcon sensor release notes identify supported operating systems for the sensor releases, making them the appropriate source for the complete platform-support information.

Custom IOCs in CrowdStrike Falcon IOC Management can use file hashes, domain names, and IP addresses as indicators. Filenames are not a Custom IOC indicator type.

A Custom IOA domain-name criterion can use a regular expression. .*badguydomain\.com.* matches the target domain, including www.badguydomain.com, while treating the periods as literal periods and allowing surrounding characters. Custom IOA rules use regular-expression logic, and a Prevent action terminates the offending process.

CrowdStrike Falcon has three built-in Real Time Response roles: Read Only Analyst, Active Responder, and Administrator. The RTR Administrator role can do everything an Active Responder can, PLUS create and manage custom scripts, upload files with the put command, and directly execute binaries with the run command. Creating RTR custom scripts is therefore reserved for the Administrator role. Option C, 'Script Developer,' is not a real Falcon RTR role and is a distractor, and Read Only Analyst / Active Responder cannot author scripts.

Reduced Functionality Mode can be triggered when a Microsoft update alters the Windows kernel and the installed sensor does not yet support that kernel change.

The Prevention Policy Debug report identifies the prevention-policy configuration and version applied to a host, allowing administrators to determine whether SBEM is absent because the host is using an outdated prevention policy.

The API Audit Trail Report records actions performed through Falcon OAuth2-based APIs, providing an audit record of API activity.

Machine Learning Exclusions allow a specified file path, such as the devcode development share, to be excluded from Falcon machine-learning detection activity, reducing false positives for trusted development code.

A Containment Policy controls the IP-address exceptions available to a network-contained host. Adding the required individual internal IP addresses permits patching and remediation while keeping containment limited to the minimum necessary access.

CrowdStrike Falcon exclusions can be applied to any selected host groups or globally to all hosts; they are not restricted to one or three host groups.

Sensor-based machine learning runs on the endpoint and identifies and analyzes previously unknown executables as they execute. This endpoint-resident analysis distinguishes it from cloud-based ML, which relies on global cloud analysis of executables.

Falcon Real Time Response (RTR) provides remote host connections for collecting host-level information. CrowdStrike’s RTR policy documentation specifies that real-time response allows users with Real Time Responder roles to remotely connect to hosts.

Behavioral detections are based on Indicators of Attack (IOAs). An IOA exclusion suppresses detections that match the specified behavioral pattern, whereas IOC exclusions concern indicators of compromise.

Certificate pinning requires the TLS certificate presented during the Cloud connection to match the certificate expected by the Falcon sensor. Deep packet inspection can intercept and re-sign TLS traffic, presenting a different certificate and preventing the pinned-certificate validation from succeeding.

Falcon Host Management provides the host inventory and supports filtering for Reduced Functionality Mode (RFM), which returns the hosts currently operating in that state.

Falcon uses role-based access control. Predefined permissions are bundled into roles; users can be assigned multiple roles based on their job function, and their effective access is cumulative across those role assignments.

The Prevention Policy Debug Report verifies the prevention-policy settings that were applied to a host, helping identify hosts with missing, outdated, or inconsistent prevention configurations.

The Workflow Execution log records workflow executions and shows the status and completion details for their individual steps, including successes and failures.

Host Management is the Falcon console’s endpoint inventory and operational-status view, where administrators can locate hosts by their offline or last-seen state, including hosts that have been offline for at least ten minutes.

A dynamic group continually includes hosts that satisfy its assignment rule, including newly discovered or newly enrolled matching hosts. An OS Version criterion of Windows 10 targets the required operating system specifically, while an OS Type criterion of Workstation can include workstations running other operating systems or versions.