Question 13 - CCFA-200 Real Exam Questions [Jan 2026 Update]s

Q: 13

A cybersecurity administrator has configured policies in the CrowdStrike Falcon Console. They have a policy for "Finance Department" with strict settings and a global policy with moderate settings. A host in the Finance Department is experiencing unexpected behavior, which leads the administrator to investigate which policy is being applied. Which policy will be applied to the host in the Finance Department if both the "Finance Department" policy and the global policy exist?

Options

Correct Answer:

Explanation

The CrowdStrike Falcon platform uses a policy precedence system based on host group priority. When a host is a member of multiple groups, each with an assigned policy, the policy from the group with the highest priority is applied. By design, specific groups like "Finance Department" are configured with a higher priority than the default (global) policy. Therefore, the more specific and higher-priority "Finance Department" policy will be the one enforced on the host, completely overriding the settings of the lower-priority global policy.

Why Incorrect

B. The global policy has the lowest precedence and is applied only when a host does not belong to any other higher-priority group.

C. CrowdStrike Falcon does not merge settings from different policies. It applies a single, complete policy based on the highest-priority group the host belongs to.

D. Policy application is determined by a static, administrator-configured priority order, not by the timestamp of the last modification.

References

1. CrowdStrike Falcon® Documentation

Host and Host Group Management Guide

Section: "Policy Precedence". The documentation states: "If a host is in multiple groups

it gets the policy from the group with the highest precedence (the lowest number)." This confirms that a single

highest-priority policy is applied

not a merged one or the global one by default.

2. CrowdStrike

Inc.

Falcon Platform: Prevention Policy Guide

Document Version 1.2

Page 5

Section: "Assigning Policies to Groups". This guide details that policies are linked to host groups and the "Default" group's policy applies to any host not in another group. This implies that membership in another group overrides the Default policy.

3. SANS Institute

Endpoint Protection and Response Courseware (FOR508)

Module 4: "Endpoint Policy Configuration and Management". The courseware

when discussing modern EDR platforms like CrowdStrike

explains that policy inheritance is based on specificity and explicit priority settings

where more granular group policies override platform-wide defaults to allow for tailored security controls.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE