Current CCFA-200b Exam Dumps [2026] Complete CrowdStrike Exam Smoothly
CCFA-200b Premium PDF & Test Engine Files with 255 Questions & Answers
NEW QUESTION # 50
You are deploying the Falcon sensor to a total of 500 hosts. Hosts in an Organizational Unit (OU) will need a specific exclusion that was previously identified. This OU is expected to add members over the next quarter.
What is the best way to create a host group for this OU?
- A. Create a static group with from list of all 500 host names.
- B. Create a static group with from list of host names in the OU
- C. Create a dynamic group with an assignment rule that filters for the OU
- D. Create a dynamic group with an assignment rule that excludes the OU
Answer: C
NEW QUESTION # 51
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group.
What is the next step to disable RTR only on these hosts?
- A. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
- B. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
- C. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
- D. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Answer: D
Explanation:
The administrator can create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result.
NEW QUESTION # 52
Which report lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported?
- A. Sensor Coverage Lookup
- B. Reduce Functionality Audit Report
- C. Sensor Health Report
- D. Inactive Sensor Report
Answer: A
Explanation:
The report that lists counts of sensors in Reduced Functionality Mode (RFM) for all operating system types, and tracks how long a sensor version will be supported is Sensor Coverage Lookup. The Sensor Coverage Lookup report allows you to view and compare the sensor versions and coverage status for each operating system type in your environment. You can use this report to identify any sensors that are in RFM or are approaching end-of-life (EOL) support.
You can also view the release date and EOL date for each sensor version.
NEW QUESTION # 53
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?
- A. Policy alignment is configured in the General Settings section under the Configuration menu
- B. Policy alignment is configured only once during the initial creation of the policy in the "Create New Policy" pop-up window
- C. Policy alignment is configured in the "Host Management" section in the Hosts application
- D. Policy alignment is configured in each policy in the "Assigned Host Groups" tab
Answer: D
Explanation:
The alignment of a particular prevention policy to one or more host groups can be completed in each policy in the "Assigned Host Groups" tab. This tab allows the administrator to select which host groups will use the policy, as well as view the number of hosts and sensors assigned to each group. The other options are either incorrect or not available.
NEW QUESTION # 54
What is likely the reason your Windows host would be in Reduced Functionality Mode (RFM)?
- A. Microsoft updates altering the kernel
- B. A Sensor Update Policy was misconfigured
- C. A misconfiguration in your prevention policy for the host
- D. The host lost internet connectivity
Answer: D
Explanation:
The likely reason your Windows host would be in Reduced Functionality Mode (RFM) is that the host lost internet connectivity. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Windows sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the %TEMP% directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud1. Losing internet connectivity is a common cause of RFM, as it prevents the sensor from communicating with the Falcon cloud. A misconfiguration in your prevention policy or sensor update policy will not cause RFM, as these policies are applied by the Falcon cloud and do not affect the sensor's license, network, or certificate status. Microsoft updates altering the kernel may cause compatibility issues with the sensor, but not RFM.
NEW QUESTION # 55
You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?
- A. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.
- B. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
- C. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"
- D. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"
Answer: A
Explanation:
The best way to ensure that a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers are not allowed to run in your environment is to use IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking. This will allow Falcon to block the execution of these hashes on the hosts using this policy. The other options are either incorrect or not efficient to achieve this goal.
NEW QUESTION # 56
Why is it important to know your company's event data retention limits in the Falcon platform?
- A. Data such as process records are kept for a shorter time than event data
- B. This is not necessary; you simply select "All Time" in your query to search all data
- C. Your query will require you to specify the data pool associated with the date you wish to search
- D. You will not be able to search event data into the past beyond your retention period
Answer: D
Explanation:
It is important to know your company's event data retention limits in the Falcon platform because you will not be able to search event data into the past beyond your retention period. The retention period is the amount of time that event data is stored in the Falcon Cloud, and it may vary depending on your subscription plan and settings. The other options are either incorrect or not related to knowing your retention limits.
NEW QUESTION # 57
The Logon Activities Report includes all of the following information for a particular user EXCEPT
__________.
- A. all hosts the user logged into
- B. the last time the user's password was set
- C. the logon type (e.g. interactive, service)
- D. the account type for the user (e.g. Domain Administrator, Local User)
Answer: A
Explanation:
Checked in console, it returns only the last machine where the user logged on, so it will not return all the machines that the user was logged on in the desired search.
NEW QUESTION # 58
Which role is required to manage groups and policies in Falcon?
- A. Falcon Host Analyst
- B. Prevention Hashes Manager
- C. Falcon Host Security Lead
- D. Falcon Host Administrator
Answer: D
Explanation:
The Falcon Host Administrator role is required to manage groups and policies in Falcon. This role allows users to create, edit and delete groups and policies, as well as assign them to hosts. The other roles do not have this capability. Reference: [CrowdStrike Falcon User Guide], page 17.
NEW QUESTION # 59
From the Host management page, what is the best field to filter by for Domain Controllers to obtain sensor version information?
- A. Platform
- B. Sensor Version
- C. OS Version
- D. Type
Answer: D
NEW QUESTION # 60
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?
- A. Using IOC Management, add the hash of the binary in question and set the action to "Allow"
- B. Contact support and request that they modify the Machine Learning settings to no longer include this detection
- C. Using IOC Management, add the hash of the binary in question and set the action to "No Action"
- D. Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
Answer: A
Explanation:
to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.
NEW QUESTION # 61
You want to create a detection-only policy. How do you set this up in your policy's settings?
- A. Set the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled. Do not activate any of the other blocking or malware prevention options.
- B. Enable the detection sliders and disable the prevention sliders. Then ensure that Next Gen Antivirus is enabled so it will disable Windows Defender.
- C. You can't create a policy that detects but does not prevent. Use Custom IOA rules to detect.
- D. Select the "Detect-Only" template. Disable hash blocking and exclusions.
Answer: A
Explanation:
The administrator can create a detection-only policy by setting the Next-Gen Antivirus detection settings to the desired detection level and all the prevention sliders to disabled in the policy's settings. This will allow Falcon to detect but not prevent threats on the hosts using this policy. Do not activate any of the other blocking or malware prevention options, as they will enable prevention actions. The other options are either incorrect or not related to creating a detection- only policy.
NEW QUESTION # 62
Your development team is working on a new enterprise application, but Falcon starts creating alerts during testing. The alert points to, "C:\Users\Bob\DevCode\felix.dll". In the detection, you see that it's triggering only on a specific Falcon IOA. What would be the best course of action for this situation?
- A. Manually turn off the built-in IOA through prevention policies
- B. Create a sensor visibility exclusion for "C:\Users\Bob\DevCode\felix.dll"
- C. Create an IOA exclusion for "C:\Users\Bob\DevCode\felix.dll"
- D. Create a Custom IOC and set it to "Allow" for "C:\Users\Bob\DevCode\felix.dll"
Answer: D
NEW QUESTION # 63
The Remote Access Graph in Visibility Reports displays:
- A. a pie chart showing a count per remote logon type
- B. a geographical chart showing the geo-location of remote IP address
- C. a bar chart where a bar represents a daily count of remote connections
- D. a graph showing connections between hosts and users
Answer: D
NEW QUESTION # 64
Where in the Falcon console can information about supported operating system versions be found?
- A. Configuration module
- B. Discover module
- C. Intelligence module
- D. Support module
Answer: D
Explanation:
Information about supported operating system versions can be found in the Support module in the Falcon console. This module provides access to various support resources, such as documentation, downloads, FAQs, release notes and system status. One of the documents available in this module is the CrowdStrike Sensor Compatibility List, which lists the supported operating system versions for each sensor type and platform. The other options are either incorrect or not related to finding information about supported operating system versions.
NEW QUESTION # 65
Why is the ability to disable detections helpful?
- A. It gives users the ability to allowlist a false positive detection
- B. It gives users the ability to set up hosts to test detections and later remove them from the console
- C. It gives users the ability to remove all data from hosts that have been uninstalled
- D. It gives users the ability to uninstall the sensor from a host
Answer: B
NEW QUESTION # 66
You need to create a rule to block all process executions of Telegram in your environment.
Which custom IOA rule configuration would accomplish this?
- A. Custom IOA rule set to Block Execution on an Image Filename of .*Telegram.*
- B. Custom IOA rule set to Detect on an Image Filename of .*Telegram.*
- C. Custom IOA rule set to Monitor on an Image Filename of .*Telegram.*
- D. Custom IOA rule configuration cannot block non-malicious binaries from executing
Answer: A
NEW QUESTION # 67
While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?
- A. Configure the Host firewall to allowlist the specific IP addresses
- B. Configure a Containment Policy with the entire internal IP CIDR block
- C. Configure a Real Time Response policy allowlist with the specific IP addresses
- D. Configure a Containment Policy with the specific IP addresses
Answer: D
Explanation:
While a host is Network contained, the administrator can allow the host to access internal network resources on specific IP addresses to perform patching and remediation by configuring a Containment Policy with the specific IP addresses. This policy allows users to specify which ports, protocols and IP addresses are allowed or blocked during network containment. The other options are either incorrect or not related to network containment.
NEW QUESTION # 68
What best describes the relationship between Sensor Update policies and Operating Systems?
- A. A Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux)
- B. Sensor Update polices are not Operating System specific. One policy can be applied to all Operating Systems
- C. Windows has its own Sensor Update polices. But Mac and Linux share Sensor Update policies
- D. Windows and Mac share Sensor Update policies. Linux requires its own set of polices based on the different kernel versions
Answer: A
Explanation:
The option that describes the relationship between Sensor Update policies and Operating Systems is that a Sensor Update policy must be configured for each Operating System (Windows, Mac, Linux). This option is essentially a repetition of question 141 and its answer.
Sensor Update policies are specific to each operating system type, as different operating systems have different sensor versions, features, and requirements. Therefore, you need to create and assign separate Sensor Update policies for each operating system type in your environment.
NEW QUESTION # 69
......
CCFA-200b Premium Files Practice Valid Exam Dumps Question: https://www.trainingquiz.com/CCFA-200b-practice-quiz.html
Get 100% Real CCFA-200b Accurate & Verified Answers As Seen in the Real Exam!: https://drive.google.com/open?id=1R-V3vyXukEKLRdOi5ogYKsXVaoF28JG2
