Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CrowdStrike
  5. CCFA

CrowdStrike CCFA Exam Questions
CrowdStrike Certified Falcon Administrator (Page 8 )

Updated On: 21-Feb-2026
Page 4 of 21
PDF with 248 Questions

How do you disable all detections for a host?

  1. Create an exclusion rule and apply it to the machine or group of machines
  2. Contact support and provide them with the Agent ID (AID) for the machine and they will put it on the Disabled Hosts list in your Customer ID (CID)
  3. You cannot disable all detections on individual hosts as it would put them at risk
  4. In Host Management, select the host and then choose the option to Disable Detections

Answer(s): D



To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

  1. Blocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule should be used instead
  2. Using IOC management, import the list of hashes and IP addresses and set the action to Detect Only
  3. Using IOC management, import the list of hashes and IP addresses and set the action to Prevent/Block
  4. Using IOC management, import the list of hashes and IP addresses and set the action to No Action

Answer(s): C



Which role is required to manage groups and policies in Falcon?

  1. Falcon Host Analyst
  2. Falcon Host Administrator
  3. Prevention Hashes Manager
  4. Falcon Host Security Lead

Answer(s): B



Which of the following can a Falcon Administrator edit in an existing user's profile?

  1. First or Last name
  2. Phone number
  3. Email address
  4. Working groups

Answer(s): D



You want the Falcon Cloud to push out sensor version changes but you also want to manually control when the sensor version is upgraded or downgraded. In the Sensor Update policy, which is the best Sensor version option to achieve these requirements?

  1. Specific sensor version number
  2. Auto - TEST-QA
  3. Sensor version updates off
  4. Auto - N-1

Answer(s): A






Post your Comments and Discuss CrowdStrike CCFA exam dumps with other Community members:

Join the CCFA Discussion