CrowdStrike CCFA-200b - CrowdStrike Falcon Certification Program

The correct report is Machine Learning Prevention Monitoring . This report helps administrators understand how machine-learning policy levels affect detection and prevention volume. It is useful during policy tuning because Falcon machine-learning settings can be staged from detection-focused configurations to prevention-focused configurations. Administrators can use this data to estimate how many events would be detected or blocked at different ML aggressiveness levels and then adjust policies with fewer surprises. Falcon Prevention Policy Debug is not the reporting feature designed for this purpose, and the Prevention Policy Audit Trail tracks administrative changes rather than activity volume. The CCFA policy tuning model relies on measuring detection and prevention outcomes before increasing enforcement, especially during staged deployment phases.

A custom IOA rule is not fully functional until its rule group is assigned to a prevention policy . Custom IOAs are created inside rule groups, and those groups must be enabled. However, Falcon applies custom IOA rule groups to endpoints through prevention policies. If the rule and rule group are enabled but not assigned to a prevention policy that applies to the target hosts, the rule will not trigger detections. There is no requirement to manually trigger the rule, and hosts are not individually selected as the primary application method. Host targeting occurs through prevention policy assignment to host groups. The CCFA guide explicitly states that rule and group enablement alone is insufficient without prevention policy assignment.

IP addresses are added to a containment policy to allow contained hosts to communicate with specific trusted resources during network containment. Network containment isolates the host to reduce attacker movement while maintaining required Falcon cloud communication. Organizations may need contained hosts to access patch servers, update sources, remediation infrastructure, domain services, or other tightly controlled internal systems. The purpose is not to automate containment based on IP address; automation is handled through workflows. Analyst permissions are controlled by user roles, not containment policy IP entries. Falcon console access is unrelated because containment policy applies to endpoint network communication, not administrative access to the web console. The course guide explicitly connects containment-policy IP allowances with patching and controlled access during containment.

Fusion SOAR workflows run automatically from Event triggers or Scheduled triggers. Event triggers execute when Falcon observes a matching event, such as a detection, incident, audit event, custom IOA detection, or other supported trigger category. Scheduled triggers run at a defined time or recurrence, allowing routine automation such as reporting, searches, or maintenance workflows. Conditions refine when a workflow continues after the trigger, but they are not triggers themselves. Actions are the tasks performed after the workflow starts, such as sending email, assigning detections, containing hosts, or running RTR commands. The CCFA workflow model separates trigger, condition, and action clearly: triggers start workflows, conditions filter logic, and actions perform outcomes.

Falcon user accounts must be created using an email address from the approved domains configured for the CID. This ensures that account creation is limited to authorized organizational identity domains and reduces the risk of adding unauthorized external users. New users are not automatically assigned the Falcon Analyst role by default; roles must be assigned according to operational need. Employee identification numbers and domain-number prefixes are not Falcon account requirements. The CCFA user management topic emphasizes identity governance, approved domains, role assignment, and least privilege. Falcon Administrators create users, assign appropriate roles, and ensure that access aligns with approved organizational identity controls. Therefore, the approved-domain email requirement is the correct statement.

To patch a network-contained host, create or update a Containment Policy that allowlists the specific IP addresses of the patch management or update sources. Containment blocks most network traffic by design, so update jobs fail unless the required update infrastructure is explicitly permitted. The course guide calls out IP addresses for Windows Update or update sources, not FQDN-based allowlisting, as the supported containment-policy exception method. Content update policies are unrelated to allowing host network traffic during containment. IP Allowlist Management controls administrative access to Falcon from specific source IPs; it does not permit contained endpoints to reach patch servers. Therefore, the containment policy must allow the patch infrastructure IPs.

A Falcon Administrator role alone does not grant the ability to initiate a Real Time Response session. RTR access is controlled by dedicated Real Time Responder roles, and the course guidance is explicit that “you must have a Real Time Responder role to connect to a host” and that “the Falcon Administrator role doesn’t include access to Real Time Response.” The administrator must be assigned one of the RTR roles, such as Real Time Responder - Read Only Analyst, Active Responder, or Administrator, depending on the level of command access required. A logged-in user on the endpoint does not prevent RTR connection, and Falcon can also connect to hosts that are network contained as long as RTR requirements are met. Another analyst session may affect operational coordination, but it is not the primary cause in this scenario. The correct CCFA topic alignment is User Management and Real Time Response role assignment.

The correct answer is to implement a Sensor Visibility Exclusion on the particular host. An SVE suppresses visibility for specified activity so that known, approved testing does not flood the Falcon console with detections or events that leadership does not need to track. This is more targeted than disabling all detections on a host and more appropriate than generating additional workflow notifications. Using RTR to kill the process would interfere with the authorized penetration test. Temporarily disabling detections may remove existing detections and suppress all detection reporting from that host, which is broader and riskier than applying a scoped exclusion. CCFA exclusion guidance stresses selecting the narrowest exclusion type that matches the operational requirement while preserving meaningful security visibility elsewhere.

The correct choice is to create a dynamic group with assignment criteria set to OS Version = Windows 10 . Dynamic host groups automatically add hosts when they match the assignment rule and automatically remove hosts when they no longer match. This is the correct group type when the requirement is to continuously include all applicable hosts across the environment without manual maintenance. Falcon’s host group documentation states that dynamic groups can use attributes such as grouping tags, IP/CIDR range, OS version, Active Directory OU, and hostname prefix or suffix, and that matching hosts are automatically added. Static groups would require manually adding each Windows 10 host and would not automatically include newly deployed Windows 10 systems. OS Type Workstation is also insufficient because it identifies a device type, not a specific operating system version. Reference topics: Group Creation, Dynamic Host Groups, Assignment Rules, OS Version Filtering.