Free CCFA Exam Braindumps
CrowdStrike Certified Falcon Administrator Questions 21–25 (page: 6)

Updated On: 9-Feb-2026

What information is provided in Logan Activities under Visibility Reports?

  1. A list of all logons for all users
  2. A list of last endpoints that a user logged in to
  3. A list of users who are remotely logged on to devices based on local IP and local port
  4. A list of unique users who are remotely logged on to devices based on the country

Answer(s): B



What can the Quarantine Manager role do?

  1. Manage and change prevention settings
  2. Manage quarantined files to release and download
  3. Manage detection settings
  4. Manage roles and users

Answer(s): B



What command should be run to verify if a Windows sensor is running?

  1. regedit myfile.reg
  2. sc query csagent
  3. netstat -f
  4. ps -ef | grep falcon

Answer(s): B



When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

  1. Custom IOA Rule Groups
  2. Custom IOC Groups
  3. Enterprise Groups
  4. Operating System Groups

Answer(s): D



Which role allows a user to connect to hosts using Real-Time Response?

  1. Endpoint Manager
  2. Falcon Administrator
  3. Real Time Responder – Active Responder
  4. Prevention Hashes Manager

Answer(s): C



Viewing page 6 of 21
Viewing questions 26 - 30 out of 248 questions


Post your Comments and Discuss CrowdStrike CCFA exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!