A Falcon administrator needs to find all hosts that are running Windows 10 and have not reported to the cloud in the last 24 hours. Which filters should be applied to the Host Management page?

OS = Windows 10 and Last Seen = 'Older than 24 hours'

Group = 'Windows' and Tag = 'Outdated'

Sensor Version = 'Latest' and Last Seen = 'Today'

Hostname contains 'Win10' and Status = 'Active'

An administrator wants to see hosts that are either in the 'Finance' group OR have the tag 'PCI'. Which filter approach will produce the correct list?

Use the OR operator to combine the group filter for Finance and the tag filter for PCI

Apply a group filter for Finance, then add a tag filter for PCI

Create a saved view that includes both filters

Apply a tag filter for PCI, then apply a group filter for Finance

An administrator is troubleshooting why a filter for 'OS = Windows' is not showing any results, even though the environment has many Windows hosts. The administrator suspects the filter is being combined with another filter. What is the most likely cause?

The host list is sorted alphabetically and Windows hosts are at the bottom

The administrator is viewing a saved view that excludes Windows hosts

The OS filter is case-sensitive and 'Windows' does not match

Another active filter is ANDed with the OS filter, narrowing the results to zero

A team lead wants to share a specific filtered view of hosts with a colleague. The colleague should be able to apply the same filters without manually recreating them. What is the recommended approach?

Save the filter configuration as a named view and tell the colleague to select that view

Take a screenshot of the filtered list and send it

Export the host list to CSV and send the file

Recreate the filters manually on the colleague's machine

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 3Objective 1

3.1 Understand How Filtering Might Be Used in the Host Management Page CCFA Practice Questions (Page 3)

Part of the Host Management and Setup domain, which makes up ~25% of our current practice bank.

20questions here

4free pages

6concepts

Questions 11–15

11application · medium
A Falcon administrator needs to find all hosts that are running Windows 10 and have not reported to the cloud in the last 24 hours. Which filters should be applied to the Host Management page?
Select an answer first
12application · medium
An administrator wants to see hosts that are either in the 'Finance' group OR have the tag 'PCI'. Which filter approach will produce the correct list?
Select an answer first
13foundation · easy
Which filter type on the Host Management page would an administrator use to display only hosts running Windows 11?
Select an answer first
14expert · medium
An administrator is troubleshooting why a filter for 'OS = Windows' is not showing any results, even though the environment has many Windows hosts. The administrator suspects the filter is being combined with another filter. What is the most likely cause?
Select an answer first
15application · medium
A team lead wants to share a specific filtered view of hosts with a colleague. The colleague should be able to apply the same filters without manually recreating them. What is the recommended approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.