CrowdStrike Certified Falcon Administrator (CCFA) Free Practice Exam Questions

234 real CrowdStrike Certified Falcon Administrator (CCFA) exam questions with answers and AI explanations. CrowdStrike certification prep — page 17 of 24.

1. Question 161: By default, how many days without successful communication must pass before a host no longer appears in the Falcon console?
2. Question 162: Which setting inside the Sensor Update Policy prevents unauthorized uninstallation?
3. Question 163: As a Falcon Administrator, you would like to tune your Prevention Policies and compare the number of detections that would have resulted in the last 30 days de…
4. Question 164: What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?
5. Question 165: Excluding mobile devices, what kind of hosts can be contained in Falcon?
6. Question 166: You have 100 hashes that have been prohibited by management and need to be blocked within your organization. Using Falcon, what is the best way to accomplish t…
7. Question 167: Which prevention policy setting monitors contents of scripts and shells for execution of malicious content?
8. Question 168: During a simulated training exercise with your security team, an analyst used Falcon to network contain a host. It was then discovered that containing this spe…
9. Question 169: How would you reset an API secret?
10. Question 170: To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows serv…