About CrowdStrike
CrowdStrike pioneered cloud-native endpoint protection with the Falcon platform, which now protects many of the largest enterprises and government agencies in the world. Its certification program validates operational expertise on Falcon across distinct security roles: platform administration (CCFA), threat hunting (CCFH), incident response (CCFR), and identity and SIEM specializations — each testing real console workflows rather than abstract theory.
Why get certified
CrowdStrike Falcon is one of the most widely deployed EDR platforms in enterprise security, and SOC teams running Falcon actively hire for certified administrators, hunters, and responders. CrowdStrike certifications demonstrate day-one operational readiness on the exact platform a security team runs — a concrete differentiator for SOC analyst, threat hunter, and incident response roles.
By the numbers
4
Exams
2,399
Questions
3
Associate
1
Professional
All CrowdStrike Certification Exams
CrowdStrike · CCFA
CrowdStrike Certified Falcon Administrator (CCFA)
Validates skills in administering the CrowdStrike Falcon platform, including sensor deployment, policy configuration, host management, and security operations. Designed for administrators and analysts with hands-on experience managing the Falcon environment.
600 questions·90 minutes
Updated · Aug 202630 freeTry a question
CrowdStrike · CCFH
CrowdStrike Certified Falcon Hunter (CCFH)
The CCFH validates a cyber threat analyst's ability to perform deep detection analysis and response, machine timelining, insider-threat investigations, and proactive threat hunting using the CrowdStrike Falcon platform.
599 questions·90 minutes
Updated · Aug 202630 freeTry a question
CrowdStrike · CCFR
CrowdStrike Certified Falcon Responder (CCFR)
Validates the ability to respond to detections within the CrowdStrike Falcon console, covering initial triage, detection investigation, proactive threat hunting, and real-time response tasks. Ideal for front-line SOC analysts and incident responders working in Falcon-protected environments.
600 questions·90 minutes
Updated · Aug 202630 freeTry a question
CrowdStrike · CCSA-205
CrowdStrike Certified SIEM Analyst (CCSA-205)
Validates the ability of security professionals to investigate detections and analyze data within the CrowdStrike Falcon Next-Gen SIEM environment. Covers querying and analytics, detection logic, incident investigation, and reporting using the Falcon platform.
600 questions·90 minutes
Updated · Aug 202630 freeTry a question
AWS
Microsoft
GCP
EC-Council
ISACA
NVIDIA
PMI
Databricks
ISC2
Confluent
HashiCorp
GitHub
GPM
RIMS
ABA
ITIL
CompTIA
Fortinet
Salesforce
Snowflake
TOGAF
Atlassian
dbt
IBM
Oracle