Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
MuleSoft
All Vendors
  2. Home
  3. Exams
  4. CrowdStrike
  5. CCFA-200

Free CrowdStrike CCFA-200 Exam Braindumps (page: 6)

96.4% Passing Rate DOWNLOAD PDF EXAM
153 Questions & Answers
Page 3 of 39

Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host.
Which role do you need added to your user account to have this capability?

  1. Real Time Responder
  2. Endpoint Manager
  3. Falcon Investigator
  4. Remediation Manager

Answer(s): A

Explanation:

The Real Time Responder role allows users to use the "Connect to Host" feature to gather additional information from the host, such as running processes, registry keys, files, etc. The other roles do not have this capability.


Reference:

CrowdStrike Falcon User Guide, page 18.



What must an admin do to reset a user's password?

  1. From User Management, open the account details for the affected user and select "Generate New Password"
  2. From User Management, select "Reset Password" from the three dot menu for the affected user account
  3. From User Management, select "Update Account" and manually create a new password for the affected user account
  4. From User Management, the administrator must rebuild the account as the certificate for user specific private/public key generation is no longer valid

Answer(s): B

Explanation:

The administrator can reset a user's password by selecting "Reset Password" from the three dot menu for the affected user account in the User Management page. This will generate a new password and send it to the user's email address. The other options are either incorrect or not available.


Reference:

CrowdStrike Falcon User Guide, page 25.



Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group.
What is the next step to disable RTR only on these hosts?

  1. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  2. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
  3. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
  4. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"

Answer(s): C

Explanation:

The administrator can create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result.


Reference:

CrowdStrike Falcon User Guide, page 35.



When creating new IOCs in IOC management, which of the following fields must be configured?

  1. Hash, Description, Filename
  2. Hash, Action and Expiry Date
  3. Filename, Severity and Expiry Date
  4. Hash, Platform and Action

Answer(s): D

Explanation:

When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac. The Action field is the action that Falcon will take when detecting the IOC, such as Detect, Block or Allow. The other fields are either optional or not available.


Reference:

CrowdStrike Falcon User Guide, page 44






Post your Comments and Discuss CrowdStrike CCFA-200 exam prep with other Community members: