Handsome Savings - Limited Time Offer 30% OFF - Ends In 0d 0h 0m 0s Coupon code: 50OFF
Trusted Worldwide Questions & Answers
Pass your CrowdStrike CCFA-200 Exam with accurate Questions & Answers
CrowdStrike Certified Falcon Administrator
Last Updated: Oct 2, 2024
153
153 Questions and Answers for the CrowdStrike CCFA-200 exam
491
Students Passed the "CrowdStrike CCFA-200" exam
94.8%
Average score during Real Exams at the Testing Centre
CrowdStrike Certified Falcon Administrator Syllabus
- User Management: This section of the exam covers how to identify roles required for access to features and functionality in the Falcon console and how to create roles and delegate them to users based on desired permissions.
- Sensor Deployment: This section covers topics such as how to determine the prerequisites to successfully install a Falcon sensor on operating systems. It also includes examining default policies and how to apply the best practices to prepare workloads for Falcon Sensor. Finally, it covers how to uninstall a Falcon Sensor.
- Host Management & Setup: In this section of the exam, the topics covered include the understanding of the filtering process in the Host Management page and how to disable detection for a host. Moreover, it covers how to explain the impact of disabling detections on a host and what is the effect of Reduced Functionality Mode (RFM). Finally, it covers how to identify hosts in RFM.
- Group Creation: In this section of the exam, topics covered include how to determine the appropriate group assignment for endpoints and understand how it can affect the implementation of policies.
- Policy Application: In this section of the exam, it is identified how to utilize the appropriate prevention policy settings for endpoints. It covers how to determine the appropriate sensor update policy settings for controlling the procedure of update. It also covers how to apply roles and policy settings and monitor RTR audit logs.
- Rule Configuration: In this section of the exam, the focus is on creating custom IOA rules to monitor for behavior that is not malicious. It also covers how to interpret business needs to ensure trusted activity and address false positives in addition to fixing performances. Finally, the section covers how to assess the IOC settings required for customized security posturing and to oversee false positives.
- Dashboards and Reports: In this section of the exam, the focus is given to understanding the different types of sensor reports and their use cases. It also covers how to comprehend various audit logs and their use cases. Workflows: It involves the understanding of setting up workflows to respond to defined triggers.