Free CrowdStrike CCFA-200b Exam Questions

Become CrowdStrike Certified with updated CCFA-200b exam questions and correct answers

Page: 1 / 33

Total 164 Questions | Updated On: Aug 18, 2026

Add To Cart

Question 1

How can a Falcon Administrator configure a pop-up message to be displayed on a host when the Falcon sensor blocks, kills or quarantines an activity?

A : By ensuring each user has set the 'pop-ups allowed' in their User Profile configuration page

B : By enabling 'Upload quarantined files' in the General Settings configuration page

C : By turning on the 'Notify End Users' setting at the top of the Prevention policy details configuration page

D : By selecting 'Enable pop-up messages' from the User configuration page

Answer: C

Question 2

What are custom alerts based on?

A : Custom workflows

B : Custom event based triggers

C : Predefined alert templates

D : User defined Splunk queries

Answer: B

Question 3

You have a Windows host on your network inReduced functionality mode (RFM). While thesystem is in RFM, which of the following is TRUE?

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventionswill not be triggered

Answer: D

Question 4

When creating an API client, which of the following must be saved immediately since it cannot be viewed again after the client is created?

A : Base URL

B : Secret

C : Client ID

D : Client name

Answer: B

Question 5

Which of the following best describes what the Uninstall and Maintenance Protection setting controls within your Sensor Update Policy?

A : Prevents automatic updates of the sensor

B : Prevents the sensor from entering Reduced Functionality Mode

C : Prevents unauthorized uninstallation of the sensor

D : Prevents modification of sensor update policy

Answer: C

Page: 1 / 33

Total 164 Questions | Updated On: Aug 18, 2026

Add To Cart