CrowdStrike Certified Falcon Administrator (CCFA) is a administrator-level CrowdStrike certification exam. The blueprint splits the exam across 5 domains, starting with Falcon Platform Administration, Sensor Deployment, Policy Configuration. On exam day you face around 60 questions in 90 minutes, in formats such as multiple-choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The CCFA is rated medium in difficulty, and most candidates prepare with at least 6 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 234+ question PDF.
Looking for more? Click here to get the full PDF with 234+ practice questions for $10 for offline study and deeper preparation.
What internet domain needs to be added to any required allowlists to allow sensors to communicate with the CrowdStrike Cloud?
What is the best way to write an ML exclusion for any executable file at "C:\Program Files\Software\"?
When performing targeted filtering for a host on the Host Management Page, which filter bar attribute is NOT case-sensitive?
When creating new IOCs in IOC management, which of the following fields must be configured?
Which Real Time Response role will allow you to see all analyst session details?
To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group. What is required to safely and successfully test your new sensor update policy on only your test Windows servers?
When deploying the Falcon Sensor alongside an existing security solution, you enable the Quarantine prevention setting in Falcon. What is the recommended configuration for both solutions?
On the Host management page which filter could be used to quickly identify all devices categorized as a "Workstation" by the Falcon Platform?
The Logon Activities Report includes all of the following information for a particular user EXCEPT __________.
What are the three configurable parts of a machine learning exclusion?
Which of the following is NOT an available filter on the Hosts Management page?
When editing an existing IOA exclusion, what can NOT be edited?
What is the name for the unique host identifier in Falcon assigned to each sensor during sensor installation?
Detections related to a penetration test on a particular server are currently generating thousands of entries in the console. Your leadership does not need to track the detections in Falcon. What should you do to allow your team to focus on more relevant detections?
Your leadership wants controls in place for immediate action on any Overwatch detections. What should you do to ensure the host is contained quickly and notifies the appropriate staff?
You need to have the ability to monitor suspicious VBA macros. Which Sensor Visibility setting should be turned on within the Prevention policy settings?
You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?
Where can you find your company's Customer ID (CID)?
The alignment of a particular prevention policy to one or more host groups can be completed in which of the following locations within Falcon?
During a Windows system investigation via Real Time Response (RTR), an RTR Active Responder is unable to execute a custom powershell script for finding specific system artifacts. What is likely restricting the responder from executing the powershell script?
No. They are original practice questions written to match the format and topic mix of the CrowdStrike Certified Falcon Administrator exam, which contains around 60 questions. Treat them as representative practice, not leaked exam content.
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 234+ questions.
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 234+ question set under timed conditions before booking the exam.
Download the complete CCFA study bundle with 234+ questions in a single printable PDF.