Get Started: CCFA-200b Exam [2026] Dumps CrowdStrike PDF Questions
CCFA-200b Premium Exam Engine pdf Download
NEW QUESTION # 32
What information is provided in Logan Activities under Visibility Reports?
- A. A list of all logons for all users
- B. A list of users who are remotely logged on to devices based on local IP and local port
- C. A list of last endpoints that a user logged in to
- D. A list of unique users who are remotely logged on to devices based on the country
Answer: C
Explanation:
The Logon Activities report under Visibility Reports provides a list of last endpoints that a user logged in to. This report shows the user name, domain name, logon type, logon time and endpoint name for each logon event. The other options are either incorrect or not related to the report.
NEW QUESTION # 33
Which is a filter within the Host setup and management > Host management page?
- A. BIOS Version
- B. Locality
- C. OU
- D. User name
Answer: C
Explanation:
OU (organizational unit) is a filter within the Host setup and management > Host management page. The Host management page allows you to view and manage all the hosts in your environment that have Falcon sensors installed. You can filter the hosts by hostname, group, OS version, sensor version, last seen date, health events, detections, and preventions. You can also filter by OU, which is a logical grouping of hosts based on their Active Directory domain structure.
NEW QUESTION # 34
When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?
- A. The sensor provides no protection, and only collects Sensor Heart Beat events
- B. The sensor would provide minimal protection
- C. The sensor would provide protection as normal, without event telemetry
- D. The sensor would function as normal
Answer: B
Explanation:
When a Linux host is in Reduced Functionality Mode (RFM), the sensor would provide minimal protection. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Linux sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the /tmp directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud.
NEW QUESTION # 35
A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?
- A. The host has a user logged into it
- B. There is another analyst connected into it
- C. They do not have an RTR role assigned to them
- D. The domain controller is preventing the connection
Answer: C
Explanation:
The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles: Real Time Response -Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response.
NEW QUESTION # 36
You need to have the ability to monitor suspicious VBA macros. Which Sensor Visibility setting should be turned on within the Prevention policy settings?
- A. Additional User Mode Data
- B. Engine (Full Visibility)
- C. Script-based Execution Monitoring
- D. Interpreter-Only
Answer: C
Explanation:
Turn on the Script-Based Execution Monitoring prevention policy setting to enable the "Falcon sensor to monitor the contents of scripts and shells that are popular mechanisms for executing malicious code on hosts. This setting does not kill or block scripts." Scripting languages:
Excel 4.0 macros
JScript
VBA Macros
VBScript
The Sensor Visibility setting that should be turned on within the Prevention policy settings to monitor suspicious VBA macros is Script-based Execution Monitoring. Script-based Execution Monitoring is a feature that enables the Falcon sensor to monitor and prevent malicious script execution on Windows systems. The feature uses machine learning and behavioral analysis to detect suspicious scripts or commands executed by various script interpreters, such as PowerShell, WScript, CScript, or Bash. VBA (Visual Basic for Applications) is a scripting language that can be embedded in Microsoft Office documents, such as Word or Excel. VBA macros can be used to automate tasks or perform actions within the documents, but they can also be abused by attackers to deliver malware or execute malicious code. Script-based Execution Monitoring can help detect and prevent such attacks by monitoring the contents of VBA macros for execution of malicious content.
NEW QUESTION # 37
What kind of hosts can be contained in Falcon?
- A. Only Windows hosts running the Falcon sensor
- B. Only Windows and Linux hosts running the Falcon sensor
- C. Only Windows and MacOS hosts running the Falcon sensor
- D. Any host running the Falcon sensor
Answer: D
NEW QUESTION # 38
Which of the following steps are required to delete a sensor update policy?
- A. Remove the policy from all assigned host groups, then click Delete from the policy's settings
- B. Remove the policy from all assigned host groups, disable the policy, then click Delete from the policy's settings
- C. From the policy's settings, disable the policy, then click Delete
- D. From the policy's settings, disable all toggles first, then click Delete
Answer: B
NEW QUESTION # 39
Which of the following pages provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System?
- A. Sensor Health
- B. Hosts Overview
- C. Support and resources
- D. Activity Overview
Answer: A
Explanation:
The page that provides a count of sensors in Reduced Functionality Mode (RFM) by Operating System is Sensor Health. The Sensor Health page allows you to view and monitor the health and status of all sensors in your environment. You can use this page to identify any sensors that have issues or errors, such as RFM, which is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. You can filter the sensors by operating system, sensor version, last seen date, health events, detections, and preventions.
NEW QUESTION # 40
You can create Fusion SOAR workflows to precisely define the actions you want Falcon to perform in response to incidents.
Which three items must be defined in every trigger so that it executes successfully?
- A. Trigger, Filter, Objective
- B. Rule Type, Condition, Action
- C. Rule Type, Filter, Objective
- D. Trigger, Condition, Action
Answer: D
NEW QUESTION # 41
How does the Unique Hosts Connecting to Countries Map help an administrator?
- A. It helps visualize global network communication
- B. It identifies connections containing threats
- C. It highlights countries with known malware
- D. It displays intrusions from foreign countries
Answer: A
Explanation:
The Unique Hosts Connecting to Countries Map helps an administrator to visualize global network communication. The map shows the number of unique hosts in your environment that have established network connections to different countries in the past 24 hours. You can use this map to identify unusual or suspicious network activity, such as connections to high-risk countries or regions, or connections from hosts that are not expected to communicate with external entities.
NEW QUESTION # 42
You are beginning the rollout of the Falcon Sensor for the first time side-by-side with your existing security solution. You need to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase. What settings do you choose?
- A. Detection slider: Moderate
Prevention slider: Disabled - B. Detection slider: Disabled
Prevention slider: Disabled - C. Detection slider: Extra Aggressive
Prevention slider: Cautious - D. Detection slider: Cautious
Prevention slider: Cautious
Answer: D
Explanation:
Explanation:The best settings to configure the Machine Learning levels of the Prevention Policy so it does not interfere with existing solutions during the testing phase are Cautious for both Detection and Prevention sliders. This setting will enable the sensor to detect and prevent only high-confidence malicious events, while allowing low-confidence events to run without interference. This setting will also generate less noise and false positives than higher settings, such as Moderate or Extra Aggressive.
NEW QUESTION # 43
Your organization has a set of servers that are not allowed to be accessed remotely, including via Real Time Response (RTR). You already have these servers in their own Falcon host group.
What is the next step to disable RTR only on these hosts?
- A. Edit the Default Response Policy and add the host group to the exceptions list under "Real Time Functionality"
- B. Create a new Response Policy and add the host name to the exceptions list under "Real Time Functionality"
- C. Edit the Default Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
- D. Create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group
Answer: D
Explanation:
The administrator can create a new Response Policy, toggle the "Real Time Response" switch off and assign the policy to the host group that contains the servers that are not allowed to be accessed remotely. This will disable RTR only on those hosts, while keeping it enabled for the rest of the hosts. Editing the Default Response Policy or adding exceptions will not achieve the desired result.
NEW QUESTION # 44
Which command would tell you if a Falcon Sensor was running on a Windows host?
- A. sc.exe query falcon
- B. cswindiag.exe -status
- C. sc.exe query csagent
- D. netstat.exe -f
Answer: C
Explanation:
The command that would tell you if a Falcon Sensor was running on a Windows host is sc.exe query csagent. This command will show the status of the csagent service, which is responsible for running the sensor on Windows systems. The output of this command will indicate if the service is running, stopped, or paused. If the service is running, the sensor is also running.
NEW QUESTION # 45
Which of the following best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy?
- A. Prevents unauthorized uninstallation of the sensor
- B. Prevents the sensor from entering Reduced Functionality Mode
- C. Prevents modification of sensor update policy
- D. Prevents automatic updates of the sensor
Answer: A
Explanation:
The option that best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy is that it prevents unauthorized uninstallation of the sensor. The Uninstall and Maintenance Protection setting is a feature that adds an extra layer of security to the sensor by requiring a maintenance token to uninstall or update the sensor manually. The maintenance token is a unique code that can be generated by a Falcon Administrator or a Real Time Response - Administrator in the Falcon console. Without a valid maintenance token, the sensor cannot be uninstalled or updated by anyone, including local administrators or malware.
NEW QUESTION # 46
What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?
- A. RFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled.
- B. RFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon
- C. RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.
- D. RFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console
Answer: C
NEW QUESTION # 47
Which of the following applies to Custom Blocking Prevention Policy settings?
- A. Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
- B. Blocklisting applies to hashes, IP addresses, and domains
- C. You can only blocklist hashes via the API
- D. Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
Answer: D
Explanation:
Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on "Upload Hashes" in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon?API.
NEW QUESTION # 48
What should be disabled on firewalls so that the sensor's man-in-the-middle attack protection works properly?
- A. Windows Proxy
- B. PowerShell
- C. Deep packet inspection
- D. Linux Sub-System
Answer: C
Explanation:
The option that should be disabled on firewalls so that the sensor's man-in-the-middle attack protection works properly is deep packet inspection. Deep packet inspection is a network configuration that inspects and modifies the data packets that pass through a firewall. Deep packet inspection may interfere with the sensor's certificate validation, which is a feature that verifies that the server certificate presented by the Falcon cloud matches a hard-coded certificate embedded in the sensor. If the certificate validation fails, the sensor will reject the connection and generate an error.
NEW QUESTION # 49
Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?
- A. Real-time offline protection
- B. Adware and Potentially Unwanted Program detection and prevention
- C. Identification and analysis of unknown executables
- D. Next-Gen Antivirus (NGAV) protection
Answer: C
Explanation:
According to documentation (documentation/detections/technique/sensor-based-ml-cst0007):
CrowdStrike sensor-based machine learning (ML) identifies and analyzes unknown executables as they run on hosts. This technique is triggered by files and file attributes associated with known malware. This is similar to the [Cloud- basedML](/support/documentation/detections/technique/cloud-based-ml) technique. Cloud-based ML is informed by global analysis of executables that classifies and identifies malware. The key difference is that it doesn't run on hosts when they're offline.
NEW QUESTION # 50
Under which scenario can Sensor Tags be assigned?
- A. While updating a sensor in the Falcon console
- B. While installing a sensor
- C. While triaging a detection
- D. While managing hosts in the Falcon console
Answer: B
Explanation:
Check in documentation, there are two kind of tags, the Falcon Grouping Tags that can be managed in falcon console or API and the Sensor Grouping Tags that are configured as parameter in cli, that kind of tags can be diferentiated because it appears with the prefix SensorGroupingTags followed with the name of the tag. If you want to modify a sensor tag is necessary change a registry key value and reboot the device or waiting until the sensor is upgraded.
NEW QUESTION # 51
Where in the console can you find a list of all hosts in your environment that are in Reduced Functionality Mode (RFM)?
- A. Inactive Sensor Report
- B. Containment Policy
- C. Host Dashboard
- D. Host Management > Filter for RFM
Answer: D
Explanation:
The place in the console where you can find a list of all hosts in your environment that are in Reduced Functionality Mode (RFM) is Host Management > Filter for RFM. The Host Management page allows you to view and manage all hosts in your environment that have Falcon sensors installed. You can use the filter bar to filter hosts by various attributes, such as status, platform, type, or group. You can also filter hosts by health events, such as RFM, which is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. By filtering for RFM, you can see a list of all hosts that are in this mode.
NEW QUESTION # 52
......
Pass Your CrowdStrike Exam with CCFA-200b Exam Dumps: https://actualtests.trainingquiz.com/CCFA-200b-training-materials.html
