CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Browse Mode
About the Exam

This exam validates knowledge, skills, and abilities to perform administrative and vulnerability management tasks within the CrowdStrike Falcon platform. It is aimed at administrators or analysts with access to the administrative side of Falcon, including security analysts, SOC analysts, security engineers, and endpoint security administrators. Passing demonstrates the ability to manage users and role-based permissions, deploy and manage sensors, configure deployment and prevention policies, create allowlists and blocklists, and produce administrative reports.

Exam Topics

  • User Management13%
  • Sensor Deployment13%
  • Host Management and Setup13%
  • Group Creation13%
  • Policy Application13%
  • Rule Configuration13%
  • Dashboards and Reports13%
  • Workflows13%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated June 22, 2026 at 8:38 AM

Topic filter
Question status
Question sort
Questions per page

QuestionQ1

VerifiedHost Management and Setup

Which option is a filter on the Host setup and management > Host management page?

Explanation

Organizational Unit (OU) is a Host Management filter used to limit displayed hosts according to their Active Directory organizational unit. CrowdStrike Falcon filtering uses host-record properties to select matching hosts.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

VerifiedHost Management and Setup

How can you locate a list of hosts that have not communicated with the CrowdStrike Cloud during the last 30 days?

Explanation

The Inactive Sensors view under Host setup and management > Managed endpoints lists hosts by their lack of communication with the CrowdStrike Cloud. Setting its time range to 30 days identifies the hosts that have been inactive for that period.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

VerifiedPolicy Application

Which of these statements best describes the Default Sensor Update policy?

Explanation

The Default Sensor Update policy is the catch-all policy: hosts that are not assigned a specific Sensor Update policy inherit its settings. It is enabled by default and includes uninstall and maintenance protection.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

VerifiedPolicy Application

What is the purpose of a containment policy?

Explanation

A containment policy defines the IP addresses that hosts in Network Containment are allowed to communicate with, preserving only approved network access while the host is isolated.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

VerifiedSensor Deployment

Which option most accurately describes the general process for manually installing the Falcon Sensor on macOS?

Explanation

Manual Falcon Sensor installation on macOS includes installing the package, licensing the sensor with falconctl, approving the system extension required by macOS, and granting the sensor Full Disk Access so it can provide the required endpoint protection functionality.

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home