CrowdStrike CCFP: CrowdStrike Certified Falcon Practitioner (CCFP)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1Cybersecurity Fundamentals

   An analyst reviews a Windows workstation where an encoded script copied files to a network share, renamed every document with a .locked extension, and left a note on the desktop. Which threat type does this activity most closely match?

   1. AA botnet agent that sits idle until its command-and-control server sends instructions
   2. BSpyware that quietly records keystrokes and sends stored credentials to a remote server
   3. CAdware that injects advertisements into the browser to generate advertising revenue
   4. DRansomware that encrypts user files and demands payment in exchange for recovery
   Show answer and explanationHide answer

   Correct answer: D

   Encrypting files, renaming them, and leaving a note that demands payment are the defining behaviours of ransomware. Spyware and botnet agents aim to steal data or wait for commands, and adware only displays advertising, so none of them matches the encryption-for-payment pattern.

2. Question 2Falcon Platform Overview

   A company has laptops in dozens of remote offices and wants an endpoint agent that adds little overhead and needs no detection servers in each office. Which architecture characteristic best meets this need?

   1. AA lightweight sensor that sends telemetry to a cloud platform for analysis
   2. BA dedicated on-premises management server deployed in each remote office location
   3. CA full signature database stored locally on every device and refreshed on a monthly schedule
   4. DA permanent VPN tunnel from every endpoint back to the central data center network
   Show answer and explanationHide answer

   Correct answer: A

   A lightweight, cloud-native sensor sends telemetry to a cloud platform for analysis, which keeps endpoint overhead low and avoids per-office detection infrastructure. The other options add local databases, on-premises servers, or permanent VPN dependencies that this design is meant to remove.

3. Question 3Core Operational Workflows

   An analyst has three open detections: a low-severity detection on a test laptop, a high-severity detection on a domain controller with confirmed suspicious activity, and a medium-severity detection on an executive's laptop. Which should be triaged first?

   1. AThe high-severity detection on the domain controller, because severity and asset criticality show the greatest impact
   2. BThe oldest detection in the queue, because it has been waiting the longest, regardless of its severity or the asset involved
   3. CThe low-severity test laptop detection, because test systems are a common source of harmless noise
   4. DThe detections in alphabetical order by hostname, so that the queue is worked in a consistent sequence
   Show answer and explanationHide answer

   Correct answer: A

   Prioritization should weigh severity and asset criticality, so the high-severity detection on a domain controller comes first. Age, hostname order, or assumed noise from a test system are not reliable reasons to set the order, and the test-laptop detection should still be checked.

4. Question 4AI and Automation in Falcon

   An analyst wants a plain-language summary of a detection and suggested next investigation steps without writing a query by hand. Which Falcon capability is designed for this?

   1. AFalcon Prevent, the module that blocks malware on endpoints
   2. BCharlotte AI, the generative AI assistant in the Falcon platform
   3. CFalcon Identity Protection, the module that monitors directory activity
   4. DFalcon Exposure Management, the module that profiles asset exposure
   Show answer and explanationHide answer

   Correct answer: B

   Charlotte AI is the generative AI assistant in the Falcon platform and can help analysts with natural-language questions and summaries. The other modules block malware, watch identity activity, or rank exposures, and none is an assistant for summarizing a detection.

5. Question 5Cybersecurity Fundamentals

   Which statement correctly distinguishes a MITRE ATT&CK tactic from a technique?

   1. AA tactic is a specific malware family, while a technique is the file hash used to identify that family in logs
   2. BA tactic is a defensive control that blocks activity, while a technique is the attacker's tool used to bypass that control
   3. CA tactic is the adversary's objective, such as Persistence, while a technique is the method used to reach it
   4. DTactics and techniques are the same category and differ only in the operating system or platform they describe
   Show answer and explanationHide answer

   Correct answer: C

   In ATT&CK, a tactic describes the attacker's goal at a given stage, such as Persistence or Discovery, and a technique describes how that goal is achieved. The other options confuse the framework with malware families, defensive controls, or platform labels.