Free CrowdStrike CCFA-200b Exam Questions

Become CrowdStrike Certified with updated CCFA-200b exam questions and correct answers

Page: 1 / 33

Total 164 Questions | Updated On: Oct 28, 2025

Add To Cart

Question 1

Which Real-Time response (RTR) role is automatically assigned to the falcon administrator ?

A : No RTR roles are automatically assigned to the Falcon administrator

B : Administrator

C : Read only analyst

D : Active Responder

Answer: A

Question 2

Which of the following is NOT an available filter on the Hosts Management page?

A : Hostname

B : Username

C : Group

D : OS Version

Answer: D

Question 3

While a host is Network contained, you need to allow the host to access internal network resources on specific IP addresses to perform patching and remediation. Which configuration would you choose?

A : Configure a Real Time Response policy allowlist with the specific IP addresses

B : Configure a Containment Policy with the specific IP addresses

C : Configure a Containment Policy with the entire internal IP CIDR block

D : Configure the Host firewall to allowlist the specific IP addresses

Answer: D

Question 4

You have a Windows host on your network inReduced functionality mode (RFM). While thesystem is in RFM, which of the following is TRUE?

A : Event reporting will be unavailable

B : System monitoring will be unavailable

C : Prevention patterns will not be triggered

D : Some detection patterns and preventionswill not be triggered

Answer: D

Question 5

What are custom alerts based on?

A : Custom workflows

B : Custom event based triggers

C : Predefined alert templates

D : User defined Splunk queries

Answer: B

Page: 1 / 33

Total 164 Questions | Updated On: Oct 28, 2025

Add To Cart