CrowdStrike CCFA: CrowdStrike Certified Falcon Administrator (CCFA)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1User Management

   A new threat hunter needs to search detections and run investigations in the Falcon console, but must not change prevention policies or create API clients. What is the most appropriate way to set up the account?

   1. AAssign a role that grants only the investigation permissions the hunter needs
   2. BCreate a shared analyst login that the whole investigation team uses
   3. CShare an existing administrator login so the hunter can start work immediately
   4. DAssign the full administrator role and ask the hunter to avoid policy pages
   Show answer and explanationHide answer

   Correct answer: A

   Role-based access should follow least privilege, so a role limited to investigation permissions meets the need without policy or API rights. Shared logins and full administrator access break accountability or least privilege, and asking a user to avoid pages is not an access control.

2. Question 2Sensor Deployment

   A team plans to deploy the Falcon sensor to a fleet of Linux servers. Which pre-deployment check matters most?

   1. AInstall a desktop environment on each server so the sensor interface can be reached
   2. BConfirm the operating system and kernel are supported and the servers can reach Falcon cloud
   3. CGive every server the same hostname so the sensors group together automatically
   4. DBlock all outbound network traffic until the sensor finishes installing on each server
   Show answer and explanationHide answer

   Correct answer: B

   Sensor installation depends on a supported operating system and kernel, and the sensor needs outbound connectivity to Falcon cloud to register. A desktop environment and identical hostnames are not requirements, and blocking outbound traffic prevents the sensor from communicating at all.

3. Question 3Host Management and Setup

   An administrator needs every host whose hostname starts with a given prefix and that runs a specific operating system. What is the best approach in Host Management?

   1. ARestart the sensor on every host so each one re-announces its hostname
   2. BExport every detection record to a spreadsheet and search each row by hand
   3. CApply filters on hostname and platform attributes to narrow the host list
   4. DCreate a prevention policy that lists the matching hostnames by name
   Show answer and explanationHide answer

   Correct answer: C

   Host Management filters let admins narrow the inventory by attributes such as hostname and platform. Detection exports return alert data rather than the host inventory, restarting sensors does not create a filtered inventory, and a prevention policy does not organize host lists.

4. Question 4Policy Application

   Which statement about prevention policy settings is accurate?

   1. APrevention settings change only when the sensor version on a host is upgraded
   2. BPrevention policies apply to the whole Customer ID and cannot be assigned to host groups
   3. CEnabling one prevention setting removes the need for any other endpoint control
   4. DEach protection category can be set to detect only or to prevent, based on the risk
   Show answer and explanationHide answer

   Correct answer: D

   Prevention policies group protection settings by category, and admins choose whether each one detects only or actively prevents. Prevention policies are assigned to host groups, a single setting never replaces other controls, and policy changes do not wait for a sensor upgrade.

5. Question 5Rules Configuration

   A custom IOA rule is firing repeatedly on a build server's scheduled scripts, which are known to be safe. Other hosts still benefit from the rule. What is the best way to reduce the noise?

   1. AAdd a narrowly scoped exclusion for the known script path on the build server group
   2. BDelete the custom IOA rule so no host receives this detection any longer
   3. CUninstall the sensor from the build server so it stops producing these detections
   4. DSet the prevention policy for every host to detect-only mode on a permanent basis
   Show answer and explanationHide answer

   Correct answer: A

   A narrowly scoped exclusion suppresses the known-good activity on one group while keeping the rule active elsewhere. Deleting the rule removes coverage everywhere, uninstalling the sensor removes protection, and permanent detect-only mode weakens prevention across the estate.