CROWDSTRIKE

CrowdStrike Certified Falcon Administrator (CCFA)

CCFA

The CrowdStrike Certified Falcon Administrator (CCFA) certification validates your ability to configure, manage, and optimize the CrowdStrike Falcon platform. It is designed for administrators and analysts who work on the administrative side of Falcon, proving they can handle day-to-day platform operations and maintain a strong security posture. Earning the CCFA demonstrates you have the hands-on skills to keep your organization's Falcon deployment running effectively.

Practice Free Questions

8Domains

30Objectives

120Practice pages

529Free questions

CCFA free practice questions

Choose any objective and open any question page — no sign-in required.

1.1 Determine roles required for access to features and functionality in the Falcon console

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

1.2 Create roles and assign users to roles based on desired permissions

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

1.3 Manage API keys

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

2.1 Determine prerequisites to successfully install a Falcon sensor on supported operating systems

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

2.2 Analyze the default policies and apply the best practices to prepare workloads for the Falcon sensor

14 questions · 3 pages

Questions 1–5 6–10 11–14

2.3 Uninstall a sensor

26 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–26

2.4 Troubleshoot a sensor

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

3.1 Understand how filtering might be used in the Host Management page

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20

3.2 Disable detections for a host

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

3.3 Explain the effect of disabling detections on a host

12 questions · 3 pages

Questions 1–5 6–10 11–12

3.4 Explain the impact of Reduced Functionality Mode (RFM) and why it might be caused

26 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–26

3.5 Find hosts in RFM

17 questions · 4 pages

Questions 1–5 6–10 11–15 16–17

3.6 Locate inactive sensors

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

3.7 Recall how long inactive sensors are retained

8 questions · 2 pages

Questions 1–5 6–8

3.8 Determine relevant reports specific to host management

8 questions · 2 pages

Questions 1–5 6–8

4.1 Determine the appropriate group assignment for endpoints and understand how this impacts the application of policies

17 questions · 4 pages

Questions 1–5 6–10 11–15 16–17

4.2 Apply best practices when managing host groups

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

5.1 Determine the appropriate prevention policy settings for endpoints and explain how this impacts security posture

6 questions · 2 pages

Questions 1–5 6–6

5.2 Determine the appropriate sensor update policy settings in order to control the update process

17 questions · 4 pages

Questions 1–5 6–10 11–15 16–17

5.3 Apply roles and policy settings, and track and review Falcon RTR audit logs in order to manage user activity

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

5.4 Understand the functionality of a containment policy

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

5.5 Configure a containment policy for IP address or subnet exclusions that will apply to network contained hosts based on security workflow requirements

14 questions · 3 pages

Questions 1–5 6–10 11–14

5.6 Understand options and requirements to manage quarantined files

12 questions · 3 pages

Questions 1–5 6–10 11–12

7.1 Understand the different types of sensor reports and their use cases

10 questions · 2 pages

Questions 1–5 6–10

7.2 Understand the different audit logs and their use cases

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

8.1 Configure workflows to respond to defined triggers

8 questions · 2 pages

Questions 1–5 6–8

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (30 objectives · 120 pages).

CrowdStrike Certified Falcon Administrator (CCFA)

CCFA free practice questions

1.1 Determine roles required for access to features and functionality in the Falcon console

1.2 Create roles and assign users to roles based on desired permissions

1.3 Manage API keys

2.1 Determine prerequisites to successfully install a Falcon sensor on supported operating systems

2.2 Analyze the default policies and apply the best practices to prepare workloads for the Falcon sensor

2.3 Uninstall a sensor

2.4 Troubleshoot a sensor

3.1 Understand how filtering might be used in the Host Management page

3.2 Disable detections for a host

3.3 Explain the effect of disabling detections on a host

3.4 Explain the impact of Reduced Functionality Mode (RFM) and why it might be caused

3.5 Find hosts in RFM

3.6 Locate inactive sensors

3.7 Recall how long inactive sensors are retained

3.8 Determine relevant reports specific to host management

4.1 Determine the appropriate group assignment for endpoints and understand how this impacts the application of policies

4.2 Apply best practices when managing host groups

5.1 Determine the appropriate prevention policy settings for endpoints and explain how this impacts security posture

5.2 Determine the appropriate sensor update policy settings in order to control the update process

5.3 Apply roles and policy settings, and track and review Falcon RTR audit logs in order to manage user activity

5.4 Understand the functionality of a containment policy

5.5 Configure a containment policy for IP address or subnet exclusions that will apply to network contained hosts based on security workflow requirements

5.6 Understand options and requirements to manage quarantined files

6.1 Create custom IOA rules to monitor for behavior that is not fundamentally malicious

6.2 Interpret business requirements in order to allow trusted activity, resolve false positives and fix performance issues

6.3 Assess IOC settings required for customized security posturing and to manage false positives

6.4 Understand configurations for CID wide management within General Settings

7.1 Understand the different types of sensor reports and their use cases

7.2 Understand the different audit logs and their use cases

8.1 Configure workflows to respond to defined triggers

CrowdStrike Certified Falcon Administrator (CCFA)

CCFA free practice questions

Domain 1 · User Management12% of practice bank · 3 objectives · 64 questions12%

Domain 2 · Sensor Deployment19% of practice bank · 4 objectives · 101 questions19%

Domain 3 · Host Management and Setup25% of practice bank · 8 objectives · 134 questions25%

Domain 4 · Group Creation7% of practice bank · 2 objectives · 36 questions7%

Domain 5 · Policy Application17% of practice bank · 6 objectives · 89 questions17%

Domain 6 · Rules Configuration13% of practice bank · 4 objectives · 68 questions13%

Domain 7 · Dashboards and Reports5% of practice bank · 2 objectives · 29 questions5%

Domain 8 · Workflows2% of practice bank · 1 objectives · 8 questions2%