CrowdStrike · CCFA
CrowdStrike Certified Falcon Administrator (CCFA) Practice Tests
Validates skills in administering the CrowdStrike Falcon platform, including sensor deployment, policy configuration, host management, and security operations. Designed for administrators and analysts with hands-on experience managing the Falcon environment.
Exam Details
Practice Questions
600
≈ 9 practice exams
Duration
90 minutes
Passing Score
80%
Difficulty
AssociateLast Updated
Aug 2026
Topics Covered
User Management and Role-Based Access ControlSensor Deployment (Windows, Linux, macOS)Host Management and Endpoint MonitoringPrevention Policies and Custom IOA RulesIOC Management and Containment PoliciesSensor Update Policies and ExclusionsReal-Time ResponseReports and Data Analysis
CrowdStrike Certified Falcon Administrator (CCFA) Practice Exam Preparation
Use this CCFA practice exam to prepare for CrowdStrike Certified Falcon Administrator (CCFA) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 600 questions for CrowdStrike CCFA, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as User Management and Role-Based Access Control, Sensor Deployment (Windows, Linux, macOS), Host Management and Endpoint Monitoring, Prevention Policies and Custom IOA Rules, and IOC Management and Containment Policies. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The CrowdStrike Certified Falcon Administrator (CCFA) is an associate-level certification that validates an individual's competency in managing and administering the CrowdStrike Falcon platform. The credential demonstrates proficiency across the full administrative lifecycle of Falcon, including deploying and managing sensors across Windows, Linux, and macOS endpoints, configuring prevention and containment policies, managing indicators of compromise (IOCs), building custom IOA rules, and leveraging Real-Time Response for live endpoint interaction.
Issued by CrowdStrike University and delivered through Pearson VUE, the CCFA is a vendor-specific credential that maps directly to hands-on platform skills rather than abstract security theory. It covers 15 distinct administrative domains—from user management and role-based access control to API client configuration and notification workflows—making it a comprehensive validation of day-to-day Falcon administration. The certification is valid for approximately two years, after which recertification is required to reflect platform updates.
Who Should Take This Exam
The CCFA is specifically designed for administrators, security analysts, and IT professionals who work with the administrative side of the CrowdStrike Falcon platform. This includes SOC analysts who manage endpoint telemetry and detections, security operations administrators responsible for sensor deployment and policy governance, and IT staff who handle endpoint protection at the organizational level.
The certification is best suited for professionals already working in environments where Falcon is deployed, particularly those in roles such as endpoint security administrator, security operations analyst, or managed security service provider (MSSP) technician. It is also valuable for security engineers at organizations that have standardized on CrowdStrike for endpoint detection and response (EDR).
Prerequisites
CrowdStrike does not mandate formal prerequisites for the CCFA exam, but strongly recommends that candidates have a minimum of six months of hands-on experience administering the Falcon platform in a production environment. This practical experience is considered essential, as the exam focuses on real-world administrative scenarios rather than conceptual knowledge.
Candidates are also encouraged to complete relevant training through CrowdStrike University before attempting the exam. A working understanding of endpoint security concepts, operating system administration across Windows, Linux, and macOS, and familiarity with security operations workflows will provide meaningful preparation. English language proficiency sufficient to comprehend technical security content is also expected.
Exam Format
The CCFA exam (code CCFA-200) consists of 60 multiple-choice questions and must be completed within a 90-minute time limit. The exam is scored on a pass/fail basis with a passing threshold of 80%. Questions are designed around real-world administrative scenarios encountered when managing the Falcon platform, emphasizing practical decision-making over rote memorization.
The exam is administered through Pearson VUE and is available via two delivery options: online proctored (OnVUE), which allows candidates to test from a home or office environment after completing a system compatibility check, or in-person at an authorized Pearson VUE Testing Center (PVTC). The exam fee is $250 USD. Candidates must ensure the name on their registration matches a government-issued ID.
Skills Measured
- 1.User Management and Role-Based Access Control (RBAC): Configuring user accounts, assigning roles, and managing access permissions within the Falcon console to enforce least-privilege principles.
- 2.Sensor Deployment: Installing and deploying the Falcon sensor across Windows, Linux, and macOS endpoints, including understanding deployment packaging and installation verification.
- 3.Host Management and Endpoint Monitoring: Filtering and organizing hosts, managing reduced functionality mode (RFM), controlling detections, and maintaining endpoint visibility across the environment.
- 4.Group Creation and Policy Precedence: Creating and managing host groups, understanding policy assignment logic, and configuring policy precedence to ensure correct enforcement across endpoint segments.
- 5.Prevention Policies: Configuring machine learning prevention levels, behavioral detections, and exploit mitigation settings to balance security posture with operational requirements.
- 6.Custom IOA Rules: Building and managing custom Indicator of Attack (IOA) rules to detect attacker behaviors and tactics not covered by default detection content.
- 7.Sensor Update Policies: Managing sensor versioning, configuring update channels, and controlling the rollout of sensor updates to endpoints.
- 8.Quarantine File Management: Reviewing and managing files quarantined by Falcon, including release, deletion, and policy configuration governing quarantine behavior.
- 9.IOC Management: Creating, importing, and managing Indicators of Compromise (IOCs) including hashes, IP addresses, and domains to block or detect known threats.
- 10.Containment Policies: Configuring network containment settings and applying containment to compromised hosts to isolate threats while maintaining administrative access.
- 11.Exclusions Configuration: Creating process, file path, and detection exclusions to reduce false positives and accommodate legitimate business applications.
- 12.Real-Time Response (RTR): Using Falcon's Real-Time Response capability to connect to live endpoints, execute scripts, collect artifacts, and perform remediation actions.
- 13.Reports and Data Analysis: Generating, scheduling, and interpreting reports within Falcon for security operations, compliance, and executive reporting purposes.
- 14.API Clients and Keys: Creating and managing API client credentials to enable integrations with third-party tools, SIEMs, and automation platforms.
- 15.Notification Workflows: Configuring notification rules and alert routing to ensure the right teams receive timely alerts based on detection severity and type.
Study Tips
- Download and study the official CCFA Certification Guide PDF from CrowdStrike University (available via the Pearson VUE CrowdStrike page) — it defines exact learning objectives for every domain tested on the exam.
- Complete all recommended CrowdStrike University training courses before the exam; CrowdStrike University offers role-based learning paths specifically aligned to CCFA objectives that cover platform navigation and administrative workflows.
- Prioritize hands-on lab time in a live or trial Falcon environment; tasks like configuring prevention policies, building custom IOA rules, and using Real-Time Response require practical familiarity that cannot be gained through reading alone.
- Practice navigating the Falcon console UI across all administrative sections — Hosts, Configuration, Response, and Investigate — since the exam tests scenario-based tasks that assume fluency with the platform interface.
- Focus study time on policy precedence and group assignment logic, as multi-policy environments with overlapping host groups are a commonly tested area that requires understanding how Falcon resolves policy conflicts.
- Use the Credly badge page for CCFA to review the 18 competency areas listed as skills tested, then self-assess your confidence in each area to identify gaps before scheduling the exam.
- Review CrowdStrike's official product documentation for Real-Time Response commands and API Clients & Keys, as these are operationally specific topics that require memorizing platform-specific syntax and workflows.
Career Benefits
The CCFA credential signals verified, platform-specific expertise in the market's leading endpoint detection and response solution — CrowdStrike protects over 70% of Fortune 100 companies, which means CCFA-certified professionals are in demand across enterprise, government, financial services, and managed security service provider sectors. Roles commonly held by CCFA-certified professionals include Falcon Administrator, SOC Analyst, Endpoint Security Engineer, and Security Operations Manager. Salary ranges for CrowdStrike-certified professionals broadly span from approximately $95,000 to over $130,000 annually at the administrator level, with senior and specialist roles commanding significantly higher compensation.
Beyond immediate job market value, the CCFA serves as a foundation for the broader CrowdStrike certification track, with more advanced credentials such as the CrowdStrike Certified Falcon Responder (CCFR) and CrowdStrike Certified Falcon Hunter (CCFH) building on the administrative knowledge validated by this exam. Organizations increasingly require vendor-specific certifications when hiring for Falcon-centric roles, making the CCFA a practical differentiator in competitive SOC and endpoint security hiring processes.
Sample Questions
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 9 full-length practice exams.
Preview — answers shown1. A new tier-1 SOC analyst at Contoso Security needs to run Real-Time Response commands on endpoints and contain hosts during incident response. The analyst must NOT be able to modify detection policies or create custom IOA rules. Which predefined Falcon role should the administrator assign? (Select one!)
AInvestigator
BAnalyst
CResponder
DAdministrator
Explanation
The Responder role is designed specifically for active incident response, providing Real-Time Response command capabilities and host containment without policy modification privileges. Administrator grants full platform access including policy creation and modification, which violates the least-privilege requirement. Analyst can read detections and manage some exclusions but does not include host containment capabilities by default. Investigator is focused on threat intelligence analysis and proactive hunting and lacks active response capabilities such as RTR commands and host containment.
2. A security analyst at Contoso Security needs to analyze threat intelligence and review existing alerts in the Falcon Console. They must NOT be able to modify prevention policies, create exclusions, or change host group assignments. Which predefined Falcon role should the administrator assign? (Select one!)
ARead Only Analyst
BInvestigator
CAdministrator
DResponder
Explanation
The Investigator role is designed for SOC Tier 2/3 analysts and threat intelligence professionals who need to analyze threat data and review alerts but are explicitly restricted from modifying policies, exclusions, or configurations. The Administrator role has full platform access including policy modification, which violates the least-privilege requirement. The Responder role is focused on incident response actions such as host containment and Real-Time Response sessions. The Read Only Analyst has broader read-only access but also cannot fulfill the threat intelligence analysis workflows that Investigator is specifically scoped for. Only Investigator maps precisely to the stated requirement of analysis without modification rights.
3. A threat hunting team at Fabrikam Corp needs to proactively search for indicators of compromise across the environment and analyze threat intelligence data. They must not be able to modify prevention policies, create host groups, or change any platform configurations. Which predefined Falcon role should the administrator assign? (Select one!)
AAdministrator
BResponder
CAnalyst
DInvestigator
Explanation
The Investigator role is specifically designed for proactive threat hunting and threat intelligence analysis. Investigators can search for indicators of compromise across the environment and analyze threat data but cannot modify prevention policies, configure host groups, or make any platform configuration changes. The Analyst role is oriented toward reviewing existing detections and incidents, managing exclusions, and creating custom IOAs and IOCs — it is reactive rather than proactively hunt-focused, and it does not align as precisely with the described threat hunting workflow. The Responder role focuses on reactive incident response actions including RTR commands and host containment, but also cannot modify policies. The Administrator role grants full platform access including all configuration capabilities, which violates the requirement to prevent policy and group modifications.
4. A Falcon administrator at Litware Corp needs to use the CrowdStrike Hosts API to retrieve a list of all hosts that have not communicated with the Falcon cloud since April 1, 2026. Which FQL filter string should be provided in the API request? (Select one!)
Alast_seen:<'2026-04-01T00:00:00Z'
Bstatus:'inactive' + last_seen:<'2026-04-01'
Clast_seen:'< 2026-04-01'
Dinactive_since:'2026-04-01T00:00:00Z'
Explanation
The correct FQL (Falcon Query Language) syntax for filtering hosts by last seen date uses the format last_seen:<'2026-04-01T00:00:00Z', where the less-than comparison operator appears immediately before the single-quoted ISO 8601 timestamp. FQL requires comparison operators to appear outside string quotes and date-time values to use the full UTC timestamp format. Placing the operator inside the quote marks as in last_seen:'< 2026-04-01' is syntactically invalid and will not return the expected results. Combining a status filter is unnecessary because filtering directly by last_seen date returns the desired host set without referencing the status field. There is no field named inactive_since in the Falcon Hosts API schema.
5. A Falcon administrator at Cromwell Insurance Group needs to assess the operational health of the sensor fleet across 8,000 endpoints and determine how many sensors are currently in Reduced Functionality Mode, broken down by operating system platform. Which Falcon console resource provides this information as a real-time summary? (Select one!)
ASensor Health Dashboard
BActivity Audit Log
CDetections Dashboard
DHost Activity Report
Explanation
The Sensor Health Dashboard is designed specifically to provide real-time fleet health metrics, including counts of sensors currently in Reduced Functionality Mode organized by platform. Administrators use this dashboard to monitor the operational state of the sensor fleet at scale without needing to manually apply filters on the Host Management page for each individual platform. The Detections Dashboard displays security detection events, threat alert volumes, and severity trends but does not present sensor operational health state information such as RFM counts. The Host Activity Report provides historical host communication and activity data but does not display RFM counts as a real-time summary segmented by operating system platform. The Activity Audit Log captures a chronological record of administrative actions performed by console users — such as policy modifications, role assignments, and configuration changes — and does not contain sensor health state metrics.
$17.99
One-time access to this exam
600 questions (9 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available