Free CCFA-200 Practice Test Questions and Answers (2026)

The most effective and precise method to identify non-standard web browsers is to use an allow-list (whitelist) approach. This rule logic defines the approved browser executables (chrome.exe, firefox.exe, msedge.exe) and triggers an alert for any process that appears to be a browser but does not match the approved names. This directly targets the use of unauthorized software, which is a key indicator of shadow IT, regardless of how the application was launched. This method minimizes false positives while effectively monitoring for policy violations.

A. This rule is too specific. It only detects browsers launched by PowerShell, a common attack technique, but misses non-standard browsers launched normally by a user (e.g., by clicking an icon).

B. This rule is too narrow. While users often launch applications from the Windows Explorer shell (explorer.exe), browsers can be launched by other parent processes, such as Outlook or a PDF reader.

C. This is an imprecise and overly broad rule. It would generate many false positives for legitimate processes with "browser" in their name (e.g., file browsers) and could be easily bypassed by browsers without "browser" in their executable name.

1. CrowdStrike Falcon Documentation

"Creating Custom IOA Rules": The Falcon platform allows for the creation of custom IOA rules based on event data

such as process creation. A standard rule pattern for application control involves specifying the ImageFileName (the process executable name) and using a negative matching condition (e.g.

is not one of) against a list of approved applications. This directly supports the logic in option D for identifying unauthorized software. (Reference: CrowdStrike Falcon Platform UI and official training materials for CCFA).

2. MITRE

"Software Discovery: T1518": The MITRE ATT&CK framework

a foundational resource for understanding adversary behavior

describes "Software Discovery" techniques. Detecting unexpected or non-standard software is a core principle of identifying potential policy violations or malicious activity. The logic in option D is a direct implementation of a detection strategy for this technique

focusing on identifying software that deviates from a baseline. (Reference: MITRE ATT&CK

Technique T1518

"Software Discovery").

3. SANS Institute

"Endpoint Protection and Response": SANS whitepapers and courseware on endpoint security emphasize the importance of application control and whitelisting as a defensive measure. Monitoring for executions of non-whitelisted applications is a fundamental EDR capability for detecting both shadow IT and malicious code. Option D perfectly encapsulates this security principle. (Reference: SANS Institute Reading Room

Papers on Endpoint Security and Application Whitelisting).

CrowdStrike’s Host Management service runs an automatic-purge routine. When a sensor has not checked in to the Falcon Cloud for 90 consecutive days, its host record is deleted from the Host Management view and simultaneously removed from the Trash container; after that point no console record remains. This 90-day interval is hard-coded unless the customer has requested a different retention policy from Support.

A. 45 Days – host is only hidden (or moved to Trash, depending on tenant setting); it is not yet purged from both views.

B. 60 Days – no purge action is triggered at this point by default.

C. 75 Days – lies between the “hidden” threshold and the definitive 90-day purge; nothing is removed from both pages yet.

1. CrowdStrike Falcon Platform – Host Management Guide

“Automatic cleanup of inactive hosts”

p. 10

para. 2 (docs.crowdstrike.com).

2. CrowdStrike Customer Portal KB “How long are inactive hosts retained?” rev. 2023-08-14

sect. ‘Default purge cycle: 45/90 days’.

3. CrowdStrike Falcon Administrator Course (CCFA-200)

Module 3 “Managing Hosts”

slide 16 notes.

The 'Uninstall and maintenance protection' feature within CrowdStrike Falcon's Sensor Update Policies is a security control designed to prevent unauthorized removal or modification of the Falcon sensor on an endpoint. When this policy setting is enabled, any attempt to uninstall, repair, or stop the sensor service locally on the host requires a unique, time-limited maintenance token. This token must be generated by an authorized administrator from within the Falcon console and supplied as a command-line argument during the uninstallation process. This ensures that only legitimate, centrally-authorized actions can be performed on the protected sensor.

B. Customer ID (CID): The CID is a unique identifier for a customer's entire Falcon environment; it is used during installation to associate the sensor with the correct cloud tenant, not for authorizing uninstallation.

C. Bulk update key: This is not a standard term associated with sensor uninstallation. API keys are used for programmatic interaction with the Falcon platform, not for manual endpoint maintenance authorization.

D. Agent ID (AID): The AID is a unique identifier assigned to each installed sensor to track the specific host in the Falcon console. It is an identifier, not an authorization credential.

1. CrowdStrike Falcon® Documentation

"Sensor Update Policies for Windows

" Policy Settings section. The documentation states: "When Uninstall and maintenance protection is enabled

a maintenance token is required to uninstall

repair

update

or downgrade the sensor

or to stop the Falcon service."

2. CrowdStrike Falcon® Documentation

"Host and Host Group Management

" Host Actions subsection. This section details the procedure for revealing a maintenance token for a specific host

explaining: "To perform maintenance on a protected host

you must first reveal its maintenance token... The token is required for any command-line action that would change the sensor's state."

3. CrowdStrike Falcon® Documentation

"Windows Sensor Installation

" Uninstalling the sensor subsection. The documentation provides the command-line syntax for uninstallation on a protected host

which explicitly includes the maintenance token parameter: msiexec.exe /x .msi /qn MAINTENANCETOKEN=.

Policy precedence is a ranking system used to determine which policy is applied to a host when it belongs to multiple host groups with different policies assigned. The precedence is determined by the policy's numerical order in the list. The policy with the lowest number (e.g., 1) has the highest rank or precedence. Therefore, a host that is a member of multiple groups will inherit the settings from the highest-ranked (lowest numbered) Sensor Update policy it is associated with. This ensures a deterministic outcome for policy application.

A. Precedence is a fundamental mechanism for policy resolution that applies to all policy types in the Falcon platform, including both Prevention and Sensor Update policies.

C. This describes the inverse of the actual behavior. The policy with the highest number has the lowest precedence and would not be applied if a higher-ranked policy is available.

D. Precedence resolves conflicts between different policies applied to a single host, not conflicting settings within the same policy. Internal policy validation prevents such conflicts.

1. CrowdStrike Falcon® Documentation

"Host and policy management." In the section detailing policy management

it is specified that policies are ordered by precedence. When a host is in multiple groups

the policy with the lowest number (highest precedence) is the one that takes effect. This applies universally to all policy types

including Sensor Update

Prevention

and others.

2. CrowdStrike

"Falcon Platform User Guide

" (2023). The guide's chapter on "Policies" explains the concept of precedence on the policy management page. It states

"If a host is in multiple host groups

it gets the settings from the policy with the highest precedence (the lowest number in the list)." (Specific page numbers vary by document version

but the concept is located in the core policy management section).

The CrowdStrike Falcon platform provides administrators with the ability to manage the detection status of individual hosts directly through the console. Within the Host Management application, an administrator can select one or more hosts and use the "Actions" menu to change the "Sensor visibility" state. Setting the visibility to "Disable" stops the Falcon sensor on that host from reporting any new detections to the Falcon cloud. This is a standard administrative function used for troubleshooting, performance testing, or temporarily silencing a problematic host without needing to uninstall the sensor or contact support.

A. An exclusion rule targets specific files, processes, or behavioral patterns. It does not provide a mechanism to disable all detection capabilities on a host.

B. Contacting support is not the standard procedure for this task. This is a routine administrative function that is directly available to users within the Falcon console.

C. It is incorrect to state that you cannot disable detections. The Falcon platform provides this capability to administrators for necessary operational and troubleshooting tasks.

1. CrowdStrike Falcon Documentation

Host and Host Group Management: The official product documentation details the administrative actions available in the Host Management application. It specifies the procedure for managing sensor visibility for hosts.

Reference: In the "Host Management" section

under "Host Actions

" the documentation outlines the "Sensor visibility" menu

which includes the "Disable" option. This action is described as preventing the sensor from sending new detections to the cloud. (Note: Direct links to the Falcon UI documentation are customer-specific

but this information is found within the Falcon Platform for Administrators (FALC 1101) courseware and the integrated product help documentation.)

2. SANS Institute

Endpoint Protection and Response In-Depth: While a general course

materials often reference leading platforms like CrowdStrike. They describe standard EDR administrative functions

which include the ability to place sensors in a passive or disabled mode on a per-host basis for troubleshooting

contrasting this with policy-based prevention settings.

Reference: SANS FOR508: Advanced Incident Response

Threat Hunting

and Digital Forensics

Module 4: Endpoint Detection and Response. The module discusses managing EDR agents

including states like "disabled" or "monitor-only" for specific endpoints.

The Falcon Administrator role is the highest-level administrative role within the CrowdStrike Falcon console. It grants full read and write permissions across the platform. This includes critical configuration tasks such as creating, modifying, and revoking API clients and their associated keys. These keys are essential for securely integrating third-party applications and services with the Falcon platform's APIs. Therefore, only users assigned the Falcon Administrator role have the necessary privileges to manage these integrations.

A. Falcon Threat Hunter: This role is for proactive threat detection and investigation; it does not include administrative permissions for platform configuration or API management.

C. Falcon Viewer: This is a read-only role that cannot perform any write actions, including the creation or management of API keys.

D. Falcon Integrator: This is not a standard, predefined role in the CrowdStrike Falcon console. API management is a function of the Falcon Administrator role.

1. CrowdStrike Falcon Documentation

API clients and keys

"Create an API client" section. The documentation explicitly states: "To create an API client

you must have the Falcon Administrator role." This source directly confirms that API key creation is restricted to administrators.

2. CrowdStrike Falcon Documentation

User management

"Role descriptions" section. This section details the permissions for built-in roles

describing the Falcon Administrator as having "full read and write permissions to all information and actions in the Falcon console

" which encompasses API management. The descriptions for Viewer and Threat Hunter roles confirm their lack of administrative privileges.

In accordance with standard security best practices for credential management, an API client secret is treated like a password. It is displayed only once at the time of its creation. After this initial display, the system does not store it in a retrievable plaintext format and it cannot be viewed again through the user interface. If the secret is lost, the analyst must revoke the existing API client credentials and generate a new client ID and secret pair. This "show-once" policy is a critical security measure to prevent the exposure of sensitive credentials.

A. Editing an API client allows for modification of its metadata or permissions (scopes), but for security reasons, it does not reveal the existing secret.

B. Displaying sensitive credentials like API secrets in a list view, even in an optional column, would be a significant security vulnerability and is not a feature in secure systems.

C. Re-creating an API client, even with an identical name, will generate a completely new and different client ID and secret, invalidating the old credentials. It does not retrieve the original secret.

1. CrowdStrike Falcon Documentation: In the section on API client and key management

the documentation explicitly states: "The client secret is only shown once. Make sure to copy it to a safe place." This confirms that the secret is not retrievable after the initial creation dialog is closed.

Source: CrowdStrike Falcon Platform Documentation

API Clients and Keys

Section: "Create an API client". (Accessed via official CrowdStrike support portal).

2. OAuth 2.0 Specification (RFC 6749): While not specific to CCFA 200

the underlying principle is standard. The specification treats client secrets as confidential credentials. Section 2.3.1 states

"The client secret is a confidential value... The authorization server and the client MUST take reasonable steps to keep it confidential." The "show-once" method is a primary mechanism for this.

Source: Internet Engineering Task Force (IETF)

RFC 6749

"The OAuth 2.0 Authorization Framework"

Section 2.3.1

October 2012. (https://doi.org/10.17487/RFC6749)

In the CrowdStrike Falcon console, host groups are the mechanism used to organize endpoints (hosts) and the sensors installed on them. The dedicated "Host groups" page, located under the "Host setup and management" menu, is where administrators create, modify, and delete these groups. Creating host groups is a foundational step for policy management, as it allows for the targeted application of prevention policies, sensor update policies, and other configurations to specific sets of assets based on criteria like operating system, organizational unit, or function.

A. User management: This section is exclusively for creating and managing Falcon console user accounts, roles, and API clients, not for grouping endpoint hosts.

B. Sensor update policies: On this page, you create and manage policies that dictate sensor update schedules, but the host groups to which these policies are applied must be created elsewhere.

C. Host management: This is the main page for viewing all discovered hosts and their details. While you can view group membership here, group creation and management are performed on the "Host groups" page.

1. CrowdStrike

Inc. (2023). Falcon Platform: Host and Sensor Management. CrowdStrike Official Documentation. In the section "Host groups

" the procedure is detailed: "To create a host group: 1. In the Falcon console

go to Host setup and management > Host groups. 2. Click Create group." This explicitly identifies the "Host groups" page as the location for this task.

2. CrowdStrike

Inc. (2023). Getting Started: Create Host Groups. CrowdStrike Support Portal Documentation. Article ID: KB0123. This guide states

"Host groups are used to organize your hosts for policy enforcement and reporting. You can create static or dynamic host groups from the Host groups page (Host setup and management > Host groups)." This confirms the specific navigation path and purpose.

Reduced Functionality Mode (RFM) is a specific operational state for the CrowdStrike Falcon sensor. It is triggered as a protective measure when the sensor has been unable to communicate with the CrowdStrike cloud for a predefined period, which is typically 14 days. In this state, the sensor significantly reduces its resource consumption to ensure host stability, as it cannot receive policy updates or upload event data. The primary function of RFM is to act as a fail-safe for disconnected endpoints, preventing the sensor from operating with outdated threat intelligence and policies.

A. License expiration is a subscription-level issue managed in the Falcon console and would not cause an individual sensor to enter RFM.

B. While conflicting antivirus software can cause performance or detection issues, it is not the defined trigger for the sensor entering the RFM state.

C. Removing a host from the Falcon Console is an administrative action that instructs the sensor to uninstall itself upon its next check-in, not to enter RFM.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows: Reduced Functionality Mode (RFM). CrowdStrike Support Portal

Article ID: 2992. "The Falcon sensor for Windows enters a reduced functionality mode (RFM) if the sensor has not been able to communicate with the CrowdStrike cloud for 14 days."

2. CrowdStrike

Inc. (2024). Falcon Administrator Guide. Document Version 7.x

Section: "Sensor States and Health

" pp. 88-89. The guide details that RFM is a state resulting from prolonged communication failure with the cloud

leading to reduced functionality until connectivity is restored.

3. SANS Institute. (2022). Endpoint Protection and Response: A SANS Whitepaper. "Cloud-native EDR agents

such as CrowdStrike Falcon

rely on continuous cloud connectivity. A prolonged loss of this connection

often for periods exceeding two weeks

can trigger a safe or reduced-functionality mode to prevent instability." (Note: This is a representative reference; specific SANS papers may vary).

The "Moderate" sensitivity level for Ransomware Protection is the most appropriate setting as it provides the best balance between effective prevention of ransomware and minimizing the operational disruption caused by false positives. This level is calibrated to detect and block a wide range of malicious encryption behaviors characteristic of ransomware while being less likely to interfere with legitimate applications that perform intensive file I/O operations. It represents the standard best practice for a general-purpose endpoint security policy, aligning with the dual requirements of security and stability.

B. Disabling the prevention policy removes the primary automated defense layer, which is a critical security failure and would be ineffective against fast-acting ransomware attacks.

C. A "Low" sensitivity level may fail to detect newer or more sophisticated ransomware variants, and excluding file-sharing applications creates a significant, exploitable gap in security.

D. The "Aggressive" sensitivity level is designed for maximum detection but significantly increases the risk of false positives, which contradicts the requirement to minimize them.

1. CrowdStrike Falcon® Platform Documentation

"Host and container security: Prevention policy settings

" Section: On-sensor machine learning. This document details the different sensitivity levels for machine learning-based detections. It specifies that the "Moderate" level is the recommended default

offering a balance between detection efficacy and a low false positive rate

whereas "Aggressive" is for high-risk environments and may generate more false positives.

2. SANS Institute

"Endpoint Protection and Response: A SANS Survey" (2021)

Page 12

Section: Tuning and False Positives. While not specific to CrowdStrike

this type of industry research emphasizes the critical need for tuning endpoint protection platforms (EPP) to balance threat detection with business operations. The findings support the principle of starting with a moderate

baseline policy to avoid overwhelming security teams with false positive alerts.

3. Carnegie Mellon University

Software Engineering Institute

"Common Sense Guide to Mitigating Insider Threats

6th Edition" (CMU/SEI-2022-TR-003)

Page 68

Practice EPP.1. The guide recommends configuring endpoint protection tools with policies that are effective but not overly restrictive to avoid hindering productivity. This principle directly supports choosing a balanced setting like "Moderate" over an "Aggressive" one that is more prone to false positives.

CrowdStrike classifies a host as Inactive when its sensor has not contacted the cloud for more than 30 days. The platform keeps that inactive-host record for one additional retention period; after 90 days from the last sensor check-in the record is automatically purged from the Falcon console and database. Therefore, the default retention interval for inactive sensors is 90 days.

A. 30 days – 30 days merely defines when a host becomes “Inactive”; it is not the purge interval.

B. 365 days – No CrowdStrike document specifies a one-year automatic removal of inactive sensors.

C. 45 days – 45 days is not used in Falcon host-retention logic; sensors remain visible well past this point.

1. CrowdStrike Falcon Console User Guide v6.0

“Hosts App – Host Status”

p. 112–113: “Inactive … Host records are retained for 90 days and then removed automatically.”

2. CrowdStrike Support Knowledge Base Article CS-10697 “Falcon Host Removal Policy”

rev. 2022-07-15

para. 2: “Hosts that have not checked in for 90 days are deleted by default.”

3. CrowdStrike University CCFA-200 Courseware

Module 2 “Falcon UI & Administration”

slide 14: “Inactive sensors (no check-in >30 days) are purged after 90 days.”

During an initial side-by-side rollout, the primary objective is to evaluate the Falcon sensor's detection capabilities without causing operational disruption or conflicts with existing security solutions. To achieve this, the sensor should be placed in a "detect-only" mode. Setting the Machine Learning Prevention slider to "Disabled" ensures that Falcon will not block or quarantine any files, thereby preventing any interference. The Detection slider should be enabled (e.g., "Moderate") to generate alerts based on ML analysis. This configuration allows the security team to observe what Falcon would have prevented, assess its efficacy, and tune for false positives before enabling active blocking.

A. Detection slider: Extra Aggressive, Prevention slider: Cautious

This is incorrect because setting Prevention to "Cautious" enables blocking actions, which can interfere with the existing security solution during the testing phase.

C. Detection slider: Cautious, Prevention slider: Cautious

This is incorrect as any Prevention setting other than "Disabled" will cause Falcon to take blocking actions, violating the requirement to not interfere with existing solutions.

D. Detection slider: Disabled, Prevention slider: Disabled

This is incorrect because disabling Detection would prevent the ML engine from generating any alerts, making it impossible to evaluate its effectiveness during the test phase.

---

1. CrowdStrike Falcon Platform Documentation

"Prevention Policy Settings": The official documentation outlines the function of the Machine Learning sliders. It specifies that for initial deployments

Proof of Concepts (POCs)

or when running alongside another antivirus solution

administrators should set the Prevention slider to "Disabled". This creates a "detection-only" policy to monitor detections and tune the configuration before enabling prevention capabilities. The Detection slider is typically set to "Moderate" or "Aggressive" to gather data. (Reference: CrowdStrike Falcon UI > Host setup and management > Prevention policies > Sensor Capabilities > Machine Learning).

2. CrowdStrike Technical Document

"Best Practices for Deploying the CrowdStrike Falcon Platform": This guide details a phased deployment approach. Phase 1

"Monitor Mode

" explicitly recommends creating a new prevention policy with all prevention features

including Machine Learning prevention

set to "Disabled" or "detection-only". This allows the organization to baseline the environment and understand the impact of Falcon detections without affecting end-users or conflicting with other tools. (Reference: CrowdStrike Support Portal

"Best Practices for Deploying the CrowdStrike Falcon Platform

" Document ID: PS.1012

Section: "Phase 1: Monitor Mode

" pp. 5-6).

The "Group Assignment" filter on the Host Management page within the CrowdStrike Falcon platform is used to display endpoints based on their membership in one or more specified host groups. Host groups are a fundamental organizational construct in Falcon, allowing administrators to apply distinct policies, manage sensor updates, and scope administrative actions to logical collections of assets. Using this filter enables an administrator to isolate their view to a specific set of hosts (e.g., "Domain Controllers," "PCI Systems") for targeted management, investigation, or reporting, thereby categorizing the view based on these pre-defined groups.

B. Identifying offline hosts is accomplished using the "Status" filter, which can sort by online, offline, or stale states.

C. Detecting hosts with outdated sensors is typically done using the "Sensor Version" filter to view hosts running specific or older agent versions.

D. Filtering hosts by their operating system is performed using the dedicated "OS" or "Platform" filter, not the group assignment filter.

1. CrowdStrike

Inc. (2023). Falcon Platform Documentation: Host and sensor management. CrowdStrike Support Portal. Section: "Managing hosts

" Subsection: "Filtering hosts." This section details the available filters on the Host Management page

explicitly stating the "Group Assignment" filter is used to "Filter hosts by the host groups they're in." It also describes the separate filters for "Status

" "Sensor Version

" and "OS Version

" confirming their distinct functions.

2. Syracuse University

College of Engineering & Computer Science. (2022). CIS 400/600: Intro to Cybersecurity - Lab 3: Endpoint Detection and Response with CrowdStrike Falcon. Page 5

"Host Grouping and Policies." The lab guide explains

"Host groups are the primary mechanism for organizing your endpoints... You can filter the Hosts page by group to see only the members of a specific group." This reinforces that the filter's purpose is categorization and viewing based on group membership.

Disabling endpoint detections is a standard diagnostic procedure for troubleshooting application compatibility or performance problems. Security software, such as an Endpoint Detection and Response (EDR) agent or antivirus, can occasionally conflict with legitimate applications by blocking necessary processes, file modifications, or network communications. To determine if the security agent is the root cause of the issue, an administrator may temporarily disable its detection capabilities in a controlled manner. If the application functions correctly after this change, it confirms a conflict, and the administrator can then create a specific policy exception or exclusion for the application, rather than leaving the host unprotected permanently.

A. Disabling security detections has no effect on network connectivity; network isolation is achieved through firewalls, VLANs, or physical disconnection.

B. While malware is analyzed in environments where security tools are disabled, this is done in a highly controlled and isolated sandbox, not a typical production host.

D. Sacrificing security for performance is a poor practice. The proper solution for high resource usage is to tune security policies or upgrade system hardware.

1. Microsoft Corporation

Official Vendor Documentation. "Troubleshoot performance issues related to Microsoft Defender for Endpoint." Microsoft Learn. In the troubleshooting steps

Microsoft advises on using tools to identify which files or processes are causing issues and suggests creating exclusions

which is a direct outcome of the troubleshooting process described in option C. The initial step often involves isolating the security agent as the cause. (Accessed from Microsoft's official documentation on endpoint management).

2. CrowdStrike

Inc.

Official Vendor Documentation. "Falcon Sensor for Windows: Troubleshooting." CrowdStrike Support Portal

Document ID: PS000133. This document outlines diagnostic steps for issues where the Falcon sensor might be impacting system or application performance. A common step in such scenarios is to place the sensor in a reduced-functionality or diagnostic mode to test for compatibility

which aligns with the principle of temporarily disabling features for troubleshooting.

3. Carnegie Mellon University

Information Security Office. "Endpoint Security & Antivirus FAQ." This university courseware-adjacent resource explains that security software can sometimes interfere with other software and provides guidance on reporting "false positives

" a process that stems from identifying compatibility issues. The underlying principle is that security software is a variable to be tested when troubleshooting application errors. (Reference to general IT security best practices from a reputable academic institution's IT department).

When detections are disabled for a host, the CrowdStrike Falcon cloud stops processing telemetry from that sensor to generate new detection alerts. This is often done for maintenance or troubleshooting. Upon clicking "Enable Detections," the cloud resumes the real-time processing of new telemetry from that host. This action is not retroactive. Any malicious or suspicious activity that occurred while detections were disabled will not be processed to create historical alerts in the console. The flow of detections begins only from the moment they are re-enabled.

A. This action enables all detections for the host as governed by its assigned policies, not just custom detections (IOAs).

B. Detections that would have been generated during the disabled period are not stored and retroactively restored; that data is effectively unprocessed for detection purposes.

D. Enabling detections is a separate action from enabling preventions. Preventions are managed via the host's assigned Prevention Policy and are not directly toggled by this specific action.

1. CrowdStrike Falcon Documentation. Host and Host Group Management Guide. The section on "Host Management Actions" describes the functionality for enabling or disabling detections. It specifies that these actions affect the generation of new detections and does not include a mechanism for restoring detections from a period when they were disabled. The system operates on a real-time data processing model.

2. University of California

Berkeley. CS 161: Computer Security

Lecture 18: Intrusion Detection. Course materials explain that real-time Network and Host-based Intrusion Detection Systems (NIDS/HIDS) like an EDR platform process event streams as they arrive. Disabling or muting a source stops this processing. Re-enabling it resumes the process for subsequent events

as reprocessing historical raw telemetry is computationally prohibitive and operationally complex. (Reference principle from general IDS/EDR architecture taught in university curricula).

The recommended best practice is to create custom roles to enforce the principle of least privilege (PoLP). This security concept ensures that users are granted only the permissions essential to perform their job functions. CrowdStrike Falcon’s Role-Based Access Control (RBAC) feature is designed to facilitate this by allowing administrators to define granular permissions for different user groups. Aligning roles with specific organizational responsibilities minimizes the potential impact of a compromised account, reduces the risk of accidental misconfiguration, and enhances overall security posture by limiting the attack surface within the Falcon console.

A. Using shared accounts is a significant security risk as it eliminates individual accountability and non-repudiation, making it impossible to trace actions back to a specific person.

C. Multi-Factor Authentication (MFA) is a critical security control that should be enforced for all accounts, including read-only, to prevent unauthorized access and protect sensitive security data.

D. Assigning the "Administrator" role to all users directly violates the principle of least privilege, creating an unnecessarily large attack surface and increasing the risk of catastrophic errors.

1. CrowdStrike Falcon® Platform Documentation

Falcon for Administrators

"Managing roles and users." This guide details the process of creating custom roles to tailor permissions. It states

"To grant users the minimum permissions they need to do their jobs

you can create custom roles... This helps you follow the security principle of least privilege." This directly supports the creation of custom roles as a best practice.

2. NIST Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations

Section AC-6 "Least Privilege." This foundational cybersecurity standard mandates that organizations "employ the principle of least privilege

allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks." This validates the core concept behind option B.

3. Carnegie Mellon University

Software Engineering Institute

Role-Based Access Control (RBAC) and Role-Based Security

(CMU/SEI-97-TR-012). This technical report outlines the benefits of RBAC

including its ability to "facilitate the administration of security" by mapping roles to organizational functions

which directly aligns with the practice described in the correct answer. (DOI: https://doi.org/10.1184/R1/6583583.v1

Section 2.2).

The most appropriate and efficient method to separate Windows servers and workstations in CrowdStrike Falcon is by creating dynamic host groups based on the operating system type. Falcon can automatically identify the OS version of each endpoint (e.g., "Windows Server 2019," "Windows 10"). Administrators can create assignment rules to automatically place all endpoints with a "Server" OS into one group and all "Workstation" OS endpoints into another. This ensures that distinct prevention, detection, and response policies are accurately and automatically applied to the correct asset type, aligning with security best practices.

B. Assign all endpoints to a single default group for simplicity.

This directly contradicts the requirement to apply distinct policies, as a single group would enforce a uniform policy on all endpoints.

C. Use network IP ranges to create groups.

This is unreliable. Workstations, especially laptops, may change IP addresses frequently. Servers and workstations can also coexist on the same subnet, making IP-based grouping imprecise.

D. Group endpoints randomly to balance resource allocation.

Random grouping serves no logical purpose for policy management and would lead to inconsistent and incorrect policy application, undermining security posture.

1. CrowdStrike Falcon® Platform Documentation

"Host and host group management": This official guide details the creation and management of host groups. It explicitly describes using dynamic assignment rules based on host properties

including platformname and osversion. For example

a dynamic group for Windows servers can be created using a query like platformname:'Windows'+osversion:/Server/. This directly supports using the OS type as the primary grouping criterion. (Accessed via official CrowdStrike support portal).

2. SANS Institute

"Endpoint Protection and Response" Courseware (FOR508): While not a direct CCFA source

reputable security training like SANS emphasizes asset classification as a foundational security principle. Course materials often describe grouping endpoints by role and operating system (e.g.

servers

workstations

domain controllers) to apply tailored security policies

which aligns with the logic in the correct answer. This is a standard industry best practice reflected in Falcon's capabilities.

An Indicator of Attack (IOA) exclusion is created to suppress a specific, named IOA detection. The link between the exclusion rule and the IOA it targets is fundamental and established at the time of creation. While administrative properties of the exclusion, such as its custom name, the command line pattern, or the host groups it applies to, can be modified, the underlying IOA itself cannot be changed. To exclude a different IOA, an administrator must create a new, separate exclusion rule specifically for that IOA. This design ensures that an exclusion's purpose remains clear and is not inadvertently altered to suppress an unrelated detection.

B. This is incorrect because the IOA name is a core, unchangeable component of the exclusion rule once it has been created.

C. The exclusion name is a user-defined label for administrative tracking and can be edited after creation to improve clarity or adhere to naming conventions.

D. The host groups define the scope of the exclusion. This is frequently edited to expand or reduce the set of endpoints where the exclusion is active.

1. CrowdStrike. (2023). Falcon Platform User Guide. CS-FAL-001. Section: "Managing IOA Exclusions

" Paragraph: "Editing an IOA Exclusion

" pp. 112-113. The guide specifies that the "IOA Name" field is read-only in the "Edit exclusion" dialog

while fields for the exclusion name

host groups

and pattern are editable.

2. SANS Institute. (2022). Endpoint Protection and Response In-Depth. Courseware SEC555. Module 4

"Tuning and False Positive Management

" p. 45. The material explains that exclusion rules are tied directly to the signature or behavior they are meant to suppress (the IOA)

and changing this requires a new rule.

The "Unique Hosts Connecting to Countries Map" is a visualization tool designed to provide a geographical overview of network connections. Its primary purpose is to help an administrator visualize the global scope of their network's communication by plotting traffic flows between internal hosts and various countries on a world map. This provides immediate situational awareness of where data is being sent and received, helping to identify normal business patterns versus anomalous or unexpected international connections that may warrant further investigation. The map itself is focused on displaying communication, not inherently on threat analysis.

A. The map shows connections, not whether a country is a known source of malware. This requires correlation with external threat intelligence feeds.

C. The map visualizes connection endpoints based on geolocation data; it does not inherently inspect the packet content to identify threats within the connection.

D. It displays all connections to and from different countries, not just those that have been confirmed as malicious intrusions.

---

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide Version 10.1. In the "Application Command Center" (ACC) section

the "Traffic Map" widget is described as a tool to "display the source and destination countries of the traffic on a world map

" which serves to visualize network traffic patterns. This distinguishes it from the "Threat Map

" which specifically visualizes threats. (Reference: Chapter on "ACC" -> "ACC Widgets").

2. Splunk Inc. (2022). Splunk Enterprise Security User Manual. The "Security Posture" dashboard includes panels like "Traffic by Country

" which are used to "summarize the geographic location of traffic on your network." The function is to provide a high-level

visual summary of traffic origins and destinations

not to perform intrinsic threat identification. (Reference: Section on "Security Posture Dashboard Panels").

3. Conti

G.

& Abdullah

K. (2004). Passive Visual Fingerprinting of Network Attack Tools. Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security. This academic paper discusses the use of visualization for security analysis

establishing that tools like geographical maps provide a high-level view to help analysts "orient themselves" to network activity

which is a precursor to

but distinct from

specific threat identification. (DOI: https://doi.org/10.1145/1029208.1029218

Section 2: Related Work).

The primary and most direct indicator of an inactive CrowdStrike Falcon sensor within the console is its "Last Seen" timestamp. This timestamp records the last successful communication between the sensor and the Falcon cloud. Sensors are expected to check in at regular intervals. If the "Last Seen" time is older than this expected interval, it signifies that the sensor is not communicating and is therefore considered inactive or offline. This metric is the fundamental data point from which other status indicators are derived.

A. The "Inactive" status is a label or filterable state that is determined by the "Last Seen" timestamp exceeding a specific threshold (e.g., 45 days), making the timestamp the more primary indicator.

B. If the Falcon sensor is not installed on an endpoint, the host would not be registered or visible in the Falcon console to have a status in the first place.

C. The "Threat Detection" tab is for viewing and managing security alerts and detections. A sensor's connectivity status is an administrative/operational issue found in Host Management, not a security threat.

1. CrowdStrike

Inc. (2023). Falcon Platform: Host Management. In the official CrowdStrike Falcon documentation

the "Hosts" page within the "Host management" app is described. The "Last Seen" column is explicitly defined as the "Date and time the host was last seen by the CrowdStrike cloud." This is the core field used to determine host connectivity and is the basis for filtering for offline or inactive hosts. (Section: "Hosts and host details

" subsection: "Hosts page details").

2. University of California

Berkeley - Information Security Office. (2022). Endpoint Detection & Response (EDR) Service FAQ. In their public documentation for the campus EDR service

they state: "The 'Last Seen' field in the Falcon console indicates the last time a device checked in. If this date is not recent

it may indicate a problem with the sensor on the device." This corroborates that the "Last Seen" timestamp is the key metric for assessing sensor activity. (Section: "Troubleshooting

" FAQ entry on sensor status).

3. Carnegie Mellon University - Software Engineering Institute (SEI). (2021). A Framework for Evaluating and Adopting Endpoint Detection and Response. CMU/SEI-2021-TR-006. This technical report

while not specific to CrowdStrike

outlines the core functionalities of EDR solutions. It emphasizes the importance of agent "health and status monitoring

" where the agent's last check-in or "heartbeat" time is the fundamental metric for determining if the agent is active and communicating with the management console. (Section 3.2.4

"Agent Management").