CCFA practice examsIn development
CrowdStrike Certified Falcon Administrator
Running a Falcon deployment: the sensor and what it does not do, host groups and policy targeting, prevention settings and the detect against prevent trade, handling a detection, and containing a host without losing the ability to investigate it.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Platform architecture, sensor deployment and host management | Not published |
| Prevention policies, detections and response | Not published |
Two sample questions
1. Which is a benefit of containing a host rather than powering it off?
- The host continues to serve its users while being investigated
- The sensor stops sending telemetry, so the attacker is blinded
- Volatile evidence and remote response access are both preserved — correct
- The host's prevention policy is escalated to its strictest level
Why: Containment preserves the running state and the remote response channel, which powering off would destroy.
2. Why is a per-host agent identifier kept distinct from the CID?
- Many hosts share one CID but each is unique — correct
- The CID changes each time a host reconnects
- The agent identifier is what names the whole tenant
- The two are interchangeable in the console
Why: The CID identifies the customer and the agent identifier the individual endpoint. Confusing them makes host-level actions ambiguous.
The real CCFA exam
| Length | 90 minutes |
|---|---|
| Questions | 60 |
| Pass mark | Not published by CrowdStrike |
| Price | Included with CrowdStrike University training |
| Recommended before you sit it | None formally. Hands-on access to a Falcon console is assumed. |
| Valid for | 2 years |
Exam facts as published by CrowdStrike; always check the vendor’s page before you book.
Study CCFA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.