CrowdStrike Certified Falcon Administrator (CCFA-200b)

✅

Reasoning: In CrowdStrike ML exclusion patterns, a single asterisk (*) acts as a wildcard that matches zero or more characters within a single path segment. It explicitly does not match directory separator characters (e.g., \ or /), meaning it won't cross directory boundaries. ❌ Why the other choices are incorrect:

• Option A is incorrect: This describes the behavior of a double asterisk (**), which matches any characters including path separators. A single asterisk does not include separators.
• Option C is incorrect: A single asterisk is a wildcard for character matching within paths, not a placeholder for a variable list.
• Option D is incorrect: A single asterisk is a general wildcard, not specifically a drive letter representation or only used to start an expression.

✅

Reasoning: To disable RTR only for a specific host group, the correct procedure is to create a new, dedicated Response Policy. Within this new policy, disable the "Real Time Response" setting. Then, assign this new policy directly to the target host group. This ensures RTR is disabled solely for those hosts, leaving other host groups unaffected by their assigned policies. ❌ Why the other choices are incorrect:

• Option A is incorrect: Editing the Default Response Policy and toggling RTR off would disable RTR for all hosts not covered by a more specific policy, not just the specified host group. This is too broad.
• Option B is incorrect: Response policies do not use "exceptions lists under Real Time Functionality" to disable RTR for entire host groups in this manner. This is not the CrowdStrike mechanism for this requirement.
• Option D is incorrect: The requirement is for a host group, not individual host names. Furthermore, using an "exceptions list" to disable core RTR functionality for a host or group is not the standard CrowdStrike method; a dedicated policy is.

✅ ****Hash, Platform and Action **

Reasoning: When creating a custom file hash IOC in the CrowdStrike Falcon console, the Hash, Platform (e.g., Windows, macOS, Linux, All), and Action (e.g., Detect, Prevent, No Action) fields are all mandatory for successful creation. ❌ Why the other choices are incorrect:

• Option A is incorrect:**
  

  
  

  ---

  ✅ Analysis:

  and Filename are optional fields. While good practice, they are not strictly required to save a hash-based IOC.
• Option B is incorrect: The Expiry Date is optional; an IOC can be set to never expire.
• Option C is incorrect: Filename, Severity, and Expiry Date are all optional fields for creating a hash-based IOC. Severity is typically associated with detections, not the IOC itself.

✅ **Real Time Responder – Read Only Analyst **

Reasoning: This role provides Real-Time Response capabilities to interact with hosts, enabling analysts to view local files and their contents. The "Read Only" attribute specifically restricts actions that would pull files off the host, directly addressing the requirement to prevent exfiltration. ❌ Why the other choices are incorrect:

• Option A is incorrect: Remediation Manager primarily manages detections and remediation tasks within the Falcon console, not direct live host interaction for file viewing.
• Option C is incorrect: Falcon Analyst – Read Only provides console-level visibility but does not grant the necessary Real-Time Response access for direct endpoint file interaction.
• Option D is incorrect: Real Time Responder – Active Responder provides full RTR capabilities, including the ability to pull files off the host, which directly contradicts the stated requirement.

✅

Reasoning: Machine Learning Exclusions allow administrators to specify file paths, hashes, or processes to be excluded from Falcon's ML-based detections. This directly addresses the scenario where legitimate development code in the "devcode" folder is continually flagged as a false positive, reducing detection noise. ❌ Why the other choices are incorrect:

• Option A is incorrect: USB Device Policy controls access to USB storage devices, which is irrelevant to false positives on a file share.
• Option B is incorrect: Firewall Rule Groups manage network traffic and connectivity, not the detection logic for local executable files.
• Option C is incorrect: Containment Policy isolates compromised hosts from the network, a reactive measure unrelated to reducing false positives for legitimate development code.