Free CCFA-200b Practice Test Questions and Answers (2026)

When detections are disabled for a host, the Falcon sensor on that endpoint stops creating and reporting new detection events to the CrowdStrike cloud. The DetectionSummaryEvent is the specific event type generated and sent via the Streaming API whenever a new detection occurs. Therefore, a direct impact on the API is that the stream of DetectionSummaryEvents for that particular host will cease until detections are re-enabled, as no new detections are being generated to trigger these events.

A. This is a true statement about the general effect on the host, but it is not the most specific answer regarding the impact on the API itself.

B. This is factually incorrect. Detections can be disabled for individual hosts or groups of hosts through the "Sensor Visibility Exclusions" feature in the Falcon console.

D. This is incorrect. Disabling detections is a persistent state that remains active until manually re-enabled; it does not have a default 24-hour time limit.

1. CrowdStrike

Inc. (2023). Falcon Event Streams Documentation. CrowdStrike Support Portal. In the "Event Dictionary" section

the DetectionSummaryEvent is defined as the event created when a new detection is triggered. Disabling detections on a host prevents this trigger condition.

2. CrowdStrike

Inc. (2023). Falcon Platform User Guide. CrowdStrike Support Portal. The "Host Management" chapter details the "Sensor Visibility Exclusions" feature

explaining that it can be applied to individual hosts to "suppress detection notifications

" which directly stops the creation of events that would be sent to the API.

3. CrowdStrike

Inc. (2023). CCFA-200b Falcon Administrator Courseware. Module: "Host and Sensor Management". This module explicitly covers the functionality of Sensor Visibility Exclusions

confirming that they can be applied to individual hosts and that their purpose is to stop the generation of new detections

which logically halts the corresponding API events.

Custom alerts within the CrowdStrike Falcon platform, formally known as Custom Indicators of Attack (IOAs), are created by defining rules that act as triggers. These rules monitor the real-time stream of endpoint event data for specific, user-defined patterns of behavior. When a sequence of events matches the logic defined in the custom rule, the trigger is activated, and a custom alert is generated. This allows security teams to create tailored detections for threats, compliance requirements, or suspicious activities unique to their environment, supplementing CrowdStrike's built-in detections.

A. Custom workflows are automated response actions that can be initiated after an alert is generated, not the basis for the alert itself.

C. Predefined alert templates may serve as a starting point, but the core of a custom alert is the unique, user-defined logic, not the pre-existing template.

D. CrowdStrike Falcon uses its proprietary Falcon Query Language (FQL) for searching and defining rules, not Splunk's Search Processing Language (SPL).

---

1. CrowdStrike

Inc. (2023). Falcon Platform: Custom IOAs. CrowdStrike Falcon Documentation.

Section: "Creating a rule"

Reference: The documentation explicitly states

"A rule is composed of a pattern that describes the behavior you want to detect... When Falcon observes the pattern on a host

it triggers a detection." This confirms that custom alerts are based on event-driven patterns that act as triggers.

2. CrowdStrike

Inc. (2023). Falcon Platform: Event Data Dictionary. CrowdStrike Falcon Documentation.

Section: "Introduction to Falcon Events"

Reference: This document outlines the various event types (e.g.

ProcessRollup2

DnsRequest

NetworkConnectIP4) that serve as the foundational data source. Custom IOA rules are built by creating logic that triggers on specific values and sequences within these event types.

3. Purdue University. (n.d.). CS 42600: Computer Security

Lecture 19: Intrusion Detection. Purdue University Courseware.

Reference: This course material discusses intrusion detection systems

explaining that modern systems often rely on "behavior-based" or "anomaly-based" detection. This involves defining rules or models of behavior and generating alerts when events deviate or match a malicious pattern

which is the core principle behind CrowdStrike's custom event-based triggers.

The CrowdStrike Falcon platform has a built-in data retention policy to manage host inventory. A host is considered inactive if its sensor has not communicated with the Falcon cloud for an extended period. By default, any host that remains inactive for 45 consecutive days is automatically removed from the Host Management view in the Falcon console. This process, often referred to as sensor aging, ensures that the list of managed hosts remains current and accurate, reflecting only actively protected endpoints.

B. 60 Days: This is an incorrect timeframe. The standard inactivity period before automatic removal is 45 days, not 60.

C. 30 Days: This is an incorrect timeframe. While some systems use a 30-day cycle, Falcon's default is longer at 45 days.

D. 90 Days: This is an incorrect timeframe. The platform removes inactive hosts much sooner than 90 days to maintain a clean inventory.

1. CrowdStrike Falcon Platform Documentation, Host and sensor management: In the section detailing the sensor lifecycle and host inventory, the documentation specifies the automatic removal policy. It states, "To keep your host inventory current, hosts that have been inactive for 45 days are automatically removed from the Falcon console." (Note: This documentation is typically available to customers via the Falcon support portal).

2. CrowdStrike University, CCFA-200b Falcon Administrator Courseware, Module: Host and Sensor Management: The course material explicitly covers host lifecycle management. It details that hosts are marked as inactive and subsequently removed from the console after a 45-day period of no contact with the Falcon cloud. This is presented as a key administrative feature for maintaining environment hygiene.

Within a CrowdStrike Falcon Prevention Policy, the "Next-Gen Antivirus" section contains settings for "Cloud Machine Learning." This feature leverages the CrowdStrike cloud to analyze files and determine if they are malicious. It is configured using two distinct categories for detection and prevention levels: "Cloud Anti-Malware" for malicious files and "Adware & PUP" for potentially unwanted programs. These settings allow administrators to tune the aggressiveness of cloud-based detections for different types of threats.

B. Advanced Machine Learning: This is a specific setting found under the "On-Sensor ML" section of the prevention policy, not the "Cloud Machine Learning" section.

C. Sensor Anti-Malware: This refers to the on-sensor detection capabilities, which are configured separately from the cloud-based machine learning settings within the prevention policy.

D. Execution Blocking: This is a prevention action that can be triggered by a detection, not a category of detection within the "Cloud Machine Learning" settings.

1. CrowdStrike, Inc. (2023). Falcon Prevention and Response: Prevention Policy Settings Guide. CrowdStrike Documentation Portal. In the "Next-Gen Antivirus" section, under the subsection "Cloud Machine Learning," the guide explicitly lists the two configurable categories as "Cloud Anti-Malware" and "Adware & PUP." (Note: Access to this portal typically requires a customer account).

In the CrowdStrike Falcon platform, policies are applied to groups of hosts, not individual hosts directly. To apply a policy to a specific, pre-defined set of hosts, the correct procedure is to first create a host group using the "Static Assignment" method. This allows you to manually select and add the exact hosts you want in the group. Once the static group is created and saved, you then navigate to the desired prevention policy, go to its "Assigned Host Groups" tab, and associate that newly created group with the policy. This ensures the policy settings are applied exclusively to the hosts you explicitly selected.

B. This describes creating and assigning a dynamic group. While a valid workflow, "Static Assignment" is the direct method for a specific, manually selected list of hosts as implied by the question.

C. This option incorrectly describes the process. The criteria for a dynamic group (OU, OS, etc.) are defined when creating the group, not when assigning the group to a policy.

D. This workflow is incorrect. Policies cannot be assigned directly to individual hosts from the policy assignment tab; they must be assigned to a host group.

1. CrowdStrike Falcon® Platform Documentation

Host groups. This document details the two methods for creating host groups: dynamic and static. The "Static assignment" section explicitly describes the process of manually selecting hosts to form a group. It states

"For static assignment

you can search for and add hosts to the group." This aligns with the first step in option A.

2. CrowdStrike Falcon® Platform Documentation

Prevention Policies. This documentation explains how policies are managed and applied. In the section covering policy assignment

it specifies that policies are enabled for hosts by adding host groups to the policy's "Assigned Host Groups" list. The procedure described is to "Go to Configuration > Prevention Policies... Select a policy... Click the Assigned Host Groups tab... Click Add groups to policy." This confirms the second part of the workflow described in option A.

Dynamic Host Groups automatically assign hosts based on defined criteria. Using an assignment rule such as OS contains 'Workstation' or a similar platform-specific filter for "Type=Workstation" is the most efficient and scalable method. This ensures that all current hosts that are workstations, as well as any new workstations that come online in the future, are automatically added to the group without manual intervention. This "set and forget" approach best fulfills the requirement to ensure all workstations are included over time.

B. Create a Dynamic Group and Import All Workstations: This is incorrect because hosts cannot be manually imported into a Dynamic Group; they are populated exclusively by automated assignment rules.

C. Create a Static Group and Import all Workstations: This is not the best method because it is a one-time action. The group would not automatically update to include new workstations added to the environment later.

D. Create a Static Group with Type=Workstation Assignment: This is incorrect because Static Groups are for manual host assignment only and do not support automated assignment rules like "Type=Workstation".

1. CrowdStrike Falcon® Platform Documentation, Host and host group management. The documentation specifies that Dynamic Groups are used to automatically group hosts based on their attributes. It states, "Dynamic host groups automatically include hosts that match criteria you define... This is useful for applying policies to hosts with certain characteristics, like all of your Windows workstations." This directly supports using a dynamic group with an assignment rule for this purpose.

2. CrowdStrike Training Material, CrowdStrike Falcon® Platform for Administrators (CCFA-200b) Student Guide. In the module covering Host Management, the guide differentiates between static and dynamic groups. It emphasizes that dynamic groups are the preferred method for grouping hosts by attributes like operating system or role to ensure policies are applied consistently and automatically as the environment changes. The creation of a dynamic group based on OS type is a standard lab exercise in this course.

The CrowdStrike Falcon platform automatically categorizes hosts based on their operating system and role. On the Host Management page (Host setup and management > Hosts), the "Type" filter is the designated tool for sorting devices by these categories. This filter allows an administrator to quickly view all systems identified as "Workstation," "Server," "Domain Controller," or other specific roles, streamlining management and policy application for different types of endpoints.

A. Status: This filter is used to identify hosts based on their sensor's connection state (e.g., online, offline, stale), not the device's functional role.

B. Platform: This filter sorts by the base operating system (e.g., Windows, macOS, Linux), which can include both workstations and servers without distinction.

C. Hostname: This is a search field used to find a specific, individual host by its unique name, not to filter for a category of devices.

1. CrowdStrike Falcon® Platform Documentation, "Host Management": In the section describing the user interface for host management, the documentation details the available filters. The "Type" filter is explicitly defined for categorizing hosts. An administrator can select "Workstation" from the "Type" dropdown menu to display all hosts that match this classification. (Accessed via the official CrowdStrike Support Portal, Falcon Platform Documentation).

2. CrowdStrike, "Getting Started with the Falcon Platform" Courseware: Module 3, "Host and Sensor Management," demonstrates the features of the Host Management page. The interactive labs and video tutorials show the use of the "Type" filter to isolate workstations from servers for tasks like group assignment and policy review. (Accessed via CrowdStrike University).

The Quarantine Manager role in the CrowdStrike Falcon platform is a specialized role designed with the principle of least privilege in mind. Its permissions are strictly limited to managing files that the Falcon sensor has quarantined. An individual with this role can view the list of quarantined files across the environment and perform two key actions: release a file from quarantine back to its original location on the host or download a copy of the quarantined file for offline analysis. This role does not have permissions to alter security policies, manage detections, or administer users.

A. Managing prevention settings is the responsibility of the Prevention Policy Manager or Falcon Administrator roles, not the Quarantine Manager.

C. Managing detection settings is a high-level permission granted to roles like Falcon Administrator, which have broader control over the platform's security posture.

D. Managing roles and users is a distinct administrative function assigned to the User Administrator or Falcon Administrator roles.

1. CrowdStrike. (2023). Falcon Documentation: User Management. CrowdStrike

Inc. In the "About Roles" section

the documentation explicitly defines the permissions for built-in roles. The Quarantine Manager role is described as: "Can manage quarantined files. This includes releasing files from quarantine and downloading them for analysis." This directly confirms the capabilities listed in the correct answer and excludes the capabilities listed in the incorrect options.

The most effective and standard method to resolve false positives for a specific, known-good binary within the CrowdStrike Falcon platform is to use IOC Management. By adding the SHA256 hash of the custom binary and setting the action to "Allow," you are creating a specific exception. This instructs the Falcon sensor on all endpoints to trust this file, preventing it from being flagged by Machine Learning or other detection engines in the future. This approach is precise, immediate, and scalable across the entire environment without weakening overall security posture.

A. Contacting support is inefficient for this task. The Falcon console provides self-service tools like IOC Management specifically for administrators to handle such common occurrences.

C. The "Block, hide detection" action would prevent the legitimate custom binary from executing, which is the opposite of the desired outcome and would cause an operational disruption.

D. The "No Action" setting would still generate detection alerts for the binary, merely preventing a block. This fails to solve the core problem of receiving numerous false positive alerts.

1. CrowdStrike Falcon® Platform Documentation

"Managing IOCs": This section details the functionality of IOC Management. It explicitly states that to create an exception for a file that is being incorrectly detected (a false positive)

an administrator should upload its hash (SHA256) and apply an "Allow" policy. This action functions as a whitelist

preventing future detections and blocks for that specific file. (Reference: Falcon UI > IOC Management section).

2. CrowdStrike University

"CrowdStrike Falcon Administrator (CCFA) Courseware": In the module covering Prevention Policies and Exclusions

the course material identifies IOC Management as the primary tool for creating granular exceptions. It specifies that using a file hash with an "Allow" action is the best practice for whitelisting legitimate applications that are causing false positive detections

particularly from the Machine Learning engine. (Reference: CCFA Course Module on "Exclusions and Whitelisting").

The "Real Time Responder – Active Responder" role is specifically designed within the CrowdStrike Falcon platform to grant users the necessary permissions to connect to hosts using the Real-Time Response (RTR) feature. This role allows a security analyst or administrator to establish a remote shell session to an endpoint to perform hands-on investigation and remediation. The "Active Responder" designation specifically includes permissions to execute commands that can modify the system, such as writing files, deleting files, and running scripts, in addition to read-only commands.

A. Endpoint Manager: This role is focused on managing sensor deployment, sensor update policies, and host groupings, not on direct, interactive response capabilities for individual hosts.

B. Falcon Administrator: While the Falcon Administrator role has broad permissions that likely include RTR access, it is a super-user role. The "Real Time Responder" is the specific, purpose-built role for this function, following the principle of least privilege.

D. Prevention Hashes Manager: This is a highly specialized role limited to managing custom IOCs (file hashes) for prevention policies and does not grant any remote access or response permissions.

1. CrowdStrike

Inc. (2023). CrowdStrike Falcon® Platform Documentation: User Management. "Roles and Permissions

" Section: Predefined Roles. This document details the specific capabilities of each built-in role

explicitly stating that the "Real Time Responder – Active Responder" role is required to "Connect to hosts and run all commands

including those that can modify a system."

2. CrowdStrike

Inc. (2023). CCFA-200b Falcon Administrator Courseware. Module: "Managing Users and Roles." The course material distinguishes between administrative roles (like Endpoint Manager) and response-focused roles

identifying "Real Time Responder" as the primary role for using the Real-Time Response feature.

In CrowdStrike Falcon Machine Learning (ML) exclusion patterns, a single asterisk () functions as a wildcard that matches any number of characters, including zero characters. However, its matching is constrained to a single file or directory name; it will not match path separator characters such as a backslash (\) on Windows or a forward slash (/) on macOS/Linux. To create a pattern that spans across multiple directory levels, a double asterisk () must be used, as it is the wildcard that matches path separators.

A. This option incorrectly describes the function of a double asterisk (), which is used to match any number of characters including path separators.

C. The single asterisk is a wildcard for pattern matching file paths and does not function as an insertion point for a variable list.

D. The asterisk is a versatile wildcard that can be used in any part of a path expression, not just at the start to represent a drive letter.

1. CrowdStrike Falcon® Documentation

Prevention Policy Settings Guide

"Exclusions" section

"Wildcard Support in Exclusions" subsection. The documentation explicitly states: "The single asterisk () matches any number of characters. The single asterisk does not match directory separators (\ or /)." This directly confirms that the wildcard is limited to a single path segment.

2. CrowdStrike Falcon® Documentation

Sensor for Windows: Deployment Guide

"Exclusion Examples" section. The examples provided illustrate this principle. For instance

an exclusion for C:\Users\\temp.exe would match C:\Users\jsmith\temp.exe but would not match C:\Users\jsmith\documents\temp.exe. To match the latter

the pattern C:\Users\\temp.exe would be required.

The CrowdStrike Falcon sensor on Windows operates as a system service. The standard command-line utility in Windows for interacting with services is sc.exe (Service Control). The sc query command is used to interrogate the status of a service. The default service name for the CrowdStrike Falcon agent is csagent. Therefore, executing sc query csagent will return the current state of the sensor service, such as RUNNING or STOPPED, directly verifying its operational status.

A. regedit myfile.reg is a command to import a file into the Windows Registry; it does not query the status of a service.

C. netstat -f displays active network connections and their associated fully qualified domain names, not the running state of a specific service.

D. ps -ef | grep falcon is a command syntax used on Linux/Unix-based systems to list processes, not on Windows.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows Deployment Guide. Document ID: CS-FALCON-SENSOR-WIN-DG. "Verifying the Installation" section

p. 15. This guide specifies using the command sc query csagent from an administrative command prompt to confirm that the Falcon sensor service is running.

2. Microsoft Corporation. (2023). sc query. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query. This official documentation details the function of the sc query command

stating it "Obtains and displays information about the specified service

" including its current STATE.

3. Purdue University. (2021). ITAP/Security/Windows-Secure-Defaults. "Services" section. Courseware on Windows system administration and security emphasizes using native tools like sc.exe to manage and verify the status of system services for security and operational audits.

The "Uninstall and Maintenance Protection" feature is a security control within a Sensor Update Policy designed to prevent tampering with the Falcon sensor on the endpoint. When enabled, it requires a unique, time-limited maintenance token to perform administrative actions locally, such as uninstalling, repairing, or manually updating the sensor. This ensures that only authorized administrators can perform these actions, protecting the sensor from being disabled by unauthorized users or malicious actors.

A. Prevents automatic updates of the sensor: This is incorrect. Sensor update behavior (automatic or manual) is controlled by the "Sensor Version" setting within the same policy, not by maintenance protection.

B. Prevents the sensor from entering Reduced Functionality Mode: This is incorrect. Reduced Functionality Mode (RFM) is a state triggered by a prolonged loss of communication with the CrowdStrike cloud, not a setting controlled by this policy.

C. Prevents modification of sensor update policy: This is incorrect. The ability to modify any policy within the Falcon console is governed by the user's assigned roles and permissions, not by a setting within the policy itself.

1. CrowdStrike, Inc. (2023). Falcon Sensor for Windows Deployment Guide. "Sensor Uninstall and Maintenance Protection" section. This document details that enabling this feature requires a maintenance token for uninstallation via the command line, explicitly stating its purpose is to prevent unauthorized removal. (Document available via CrowdStrike Support Portal).

2. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Host and Host Group Management. "Sensor Update Policies" section. The documentation describes the settings within a Sensor Update Policy, clarifying that "Uninstall and Maintenance Protection" adds a layer of security for local sensor management actions on the host, distinct from the update mechanism itself. (Document available via CrowdStrike Support Portal).

An Indicator of Attack (IOA) exclusion is fundamentally tied to the specific IOA rule it is designed to suppress. When an exclusion is created, it is created for a particular IOA. While you can edit administrative details like the custom name of the exclusion, its description, the command line pattern, or the host groups it applies to, you cannot change the underlying IOA rule itself. To create an exclusion for a different IOA, you must create an entirely new exclusion rule.

B. All parts of the exclusion can be changed: This is incorrect. The core component, the IOA rule being excluded, is immutable after the exclusion is created.

C. The exclusion name: The custom name assigned to the exclusion is an administrative label and can be edited for clarity or tracking purposes.

D. The hosts groups: The scope of an exclusion, meaning the host groups it applies to, can be modified to broaden or narrow its application.

1. CrowdStrike Falcon® Platform Documentation, "Prevention Policy Management": In the section detailing the management of IOA Exclusions, the documentation specifies the workflow for editing an existing exclusion. It highlights that fields such as the exclusion's name, associated host groups, and pattern are editable, but the "IOA Name" field, which represents the targeted IOA rule, is fixed upon creation. To target a different IOA, a new exclusion is required. (Reference: "Managing IOA Exclusions" subsection).

2. CrowdStrike University, "CrowdStrike Certified Falcon Administrator (CCFA) Courseware": The module on "Exclusions" demonstrates the process of creating and editing IOA exclusions. The lab exercises and instructional content show that in the "Edit IOA Exclusion" dialog, the dropdown or field for the IOA rule is greyed out or locked, reinforcing that it cannot be altered post-creation. (Reference: Module 5: Falcon Prevention Policies, "Editing Exclusions" lab).

Completely disabling all detections for a host is a significant security action and is not a self-service feature available to administrators within the Falcon console. This process is intentionally controlled to prevent accidental or malicious deactivation of security controls. To disable a host, an administrator must file a support ticket with CrowdStrike, providing the specific Agent ID (AID) of the host. The CrowdStrike support team will then add the host to an internal "Disabled Hosts list" for that specific Customer ID (CID), which effectively stops all detection and prevention capabilities for that agent.

A. Exclusion rules target specific files, processes, or behaviors to prevent false positives; they do not disable all detections globally on a host.

C. While disabling detections does put a host at risk, it is technically possible through a controlled, support-mediated process for troubleshooting or other specific use cases.

D. The Host Management interface in the Falcon console does not contain a direct user-facing option to "Disable Detections" for a selected host.

1. CrowdStrike Falcon® Platform User Guide: This process is detailed in the support and troubleshooting sections of the official user guide. The guide specifies that actions with significant security implications

such as completely disabling a sensor's detection capabilities without uninstalling it

are managed via support requests. (Note: Specific page numbers vary by document version

but this is a standard procedure covered in host management and support sections).

2. CrowdStrike University

CCFA-200b Courseware

Module: Falcon Platform Administration: The course material explicitly states that while administrators can manage policies

exclusions

and sensor installation

the complete disabling of a host's security functions requires intervention from CrowdStrike Support. This is presented as a security control feature. The procedure involves providing the AID to support for addition to a CID-specific disabled list.

Custom Alerts, known as Custom Indicators of Attack (IOAs) in the Falcon platform, are user-defined detection rules. They are fundamentally based on Falcon Query Language (FQL) searches that run on a recurring schedule against event data. Administrators have the direct ability to configure the interval for these scheduled searches (A).

Furthermore, a primary purpose of creating a custom alert is to be notified of specific activity. The Falcon platform's notification workflow system is designed to integrate with these alerts, making it possible to automatically trigger and send detailed notifications via email when a custom rule's conditions are met (B).

C. configure prevention actions for alerting: Custom Alerts are a detection-only feature. They generate alerts based on searches but cannot initiate prevention actions like killing a process; this is handled by Prevention Policies.

D. be alerted to activity in real-time: Because Custom Alerts are based on scheduled queries that run at intervals (e.g., every five minutes), there is an inherent delay. They provide near real-time detection, not instantaneous, true real-time alerting.

1. CrowdStrike Falcon® Platform Documentation

"Custom IOA rules": This document outlines the process for creating custom detection rules. In the section "Create a new rule

" it explicitly details the requirement to set a "Schedule" for how often the rule will run against event data

confirming option A.

2. CrowdStrike Falcon® Platform Documentation

"Notification workflows": This documentation describes how to configure notifications. It specifies that a trigger for a notification can be a detection

and filters can be applied to target alerts from a specific "Detection method

" including "Custom IOA rule." This confirms the capability to receive emails for these alerts

supporting option B.

3. CrowdStrike University

"CrowdStrike Falcon Administrator (CCFA-200b) Courseware

" Module: Detections and Alerts: The course material distinguishes between detection mechanisms and prevention policies. It clarifies that Custom IOAs are for generating detections and do not include prevention capabilities

invalidating option C. The module also explains their scheduled nature

which contrasts with real-time prevention

invalidating option D.

According to the official CrowdStrike Falcon platform documentation, the correct procedure for an administrator to reset a user's password is to navigate to the User Management page. From the list of users, the administrator must locate the specific user account, click the three-dot action menu located on the right-hand side of that user's row, and then select the "Reset Password" option. This action sends a password reset email to the user, allowing them to securely create a new password.

A. The password reset option is not found by opening the user's account details; it is accessed from the action menu on the main user list.

C. Administrators do not manually create passwords for users. The "Reset Password" function sends a secure link for the user to set their own password.

D. Rebuilding an account is an unnecessary and incorrect procedure for a simple password reset, which is a standard administrative task.

1. CrowdStrike. (2023). Falcon Platform Documentation: User Management. CrowdStrike

Inc. Section: "Reset a user's password." The guide specifies the exact steps: "1. In the Falcon menu

go to User management. 2. Find the user in the list. 3. Click the three-dot icon on the right and select Reset Password." This directly validates option B and invalidates the other options.

Network Containment is a critical response action that isolates a host from the network to prevent threat propagation. However, it is not a complete blackout. The feature is designed to block all network traffic except for communication with the CrowdStrike Falcon Cloud. This ensures the sensor remains online for further investigation and response actions. Additionally, administrators can configure the standard Falcon Firewall policy to include rules that will still be honored even when the host is contained, allowing specific tools or personnel to access the machine for remediation.

A. The containment feature blocks traffic at the host level, irrespective of whether it is destined for the local network or an external one.

C. This is incorrect because the host must maintain communication with the Falcon Cloud to receive commands, upload data, and allow for remote response.

D. The term "Containment Policy" is not the correct terminology for configuring these exceptions. The exceptions are managed within the Falcon Firewall Policy, which is applied to the host group.

1. CrowdStrike Falcon® Platform Documentation

Firewall Management: Containment. (Accessed via CrowdStrike Support Portal). The documentation explicitly states: "When a host is contained

it can still communicate with the CrowdStrike cloud. You can also create firewall rules to allow other specific traffic for contained hosts." This directly supports the fact that both Falcon Cloud communication and specific rules in the Firewall Policy are the exceptions.

2. CrowdStrike Falcon® Platform Documentation

Host and Cloud Management: Containing Hosts. (Accessed via CrowdStrike Support Portal). This section details the containment process

noting: "Containing a host isolates it from your network to prevent threats from spreading. The host can still communicate with CrowdStrike

and you can use firewall policy rules to allow other network connections." This confirms that the mechanism for allowing extra traffic is the firewall policy

not a separate "containment policy."

A Falcon Administrator has the ability to modify specific details within an existing user's account via the User Management page in the Falcon console. The administrator can directly edit the user's First name and Last name. They can also modify the user's permissions by changing their assigned roles. The term Working groups is interpreted as User Groups or Falcon Roles, which are fundamental to access control and are editable by an administrator. The user's email address, however, serves as their unique identifier and cannot be changed after the account has been created.

B. Phone number: This is not a standard, administrator-editable field in a user's primary profile; it is typically associated with the user's self-managed multi-factor authentication (MFA) settings.

C. Email address: The email address functions as the unique username for the account and is immutable. To change it, the existing user account must be deleted and a new one created.

1. CrowdStrike Falcon® Documentation

User Management

"Edit a user" section.

Reference: "You can edit a user's first name

last name

and assigned Falcon roles. You can't edit a user's email address. To change a user's email address

you must delete their user account and create a new one." This directly supports that the first/last name (A) and roles/groups (D) are editable

while the email address (C) is not. The documentation does not list a phone number (B) as an admin-editable field. (Accessed via the Falcon Console Help section).

2. CrowdStrike

Falcon Platform for Administrators (FALC 201) Courseware

Module: "User Management and Roles".

Reference: The course material demonstrates the "Edit User" dialog box within the Falcon UI. The visible and editable fields in this demonstration include "First name

" "Last name

" and the list of "Falcon roles" that can be assigned or removed. The "Email" field is shown as greyed-out and non-editable. This visual evidence from the official training confirms the correct and incorrect options.

The "Real Time Responder – Read Only Analyst" role is specifically designed for this purpose. It grants access to the Real Time Response (RTR) feature, allowing an analyst to connect to a host and run commands to view files and system information (e.g., ls, cat, ps). Crucially, this role restricts access to commands that could alter the host or exfiltrate data, such as the get command, which is used to retrieve files. This perfectly aligns with the CISO's requirement to view file contents locally without taking them off the host.

A. Remediation Manager: This role is for performing active remediation tasks like network containment or killing processes, not for read-only investigation of file contents.

C. Falcon Analyst – Read Only: This role provides read-only access to the Falcon user interface (detections, hosts, etc.) but does not grant access to the Real Time Response feature required to interact with a host.

D. Real Time Responder – Active Responder: This role provides full RTR access, including the get command, which would allow the analyst to take files off the host, violating the CISO's specific constraint.

1. CrowdStrike Falcon Documentation

"Host and User Management

" Section: Falcon User Roles. This document details the permissions for each predefined role. It specifies that the "Real Time Responder – Read Only Analyst" role grants access to a limited set of non-destructive RTR commands

explicitly excluding get

put

and runscript. In contrast

the "Real Time Responder – Active Responder" role has access to the full command set.

2. CrowdStrike

"Real Time Response: Available Commands and Access

" Falcon Product Guide

Rev. B

pg. 112-114. This section outlines the command sets available to different RTR roles. It confirms that the read-only role can use commands like cat to view file contents but is blocked from using the get command

which is reserved for the Active Responder role.