CCFA Practice Test

CCFA practice test: what's covered

• Certified Falcon Administrator
• EDR/XDR

Free CCFA sample questions

1. A new tenant has been provisioned in the EU-1 cloud. An admin tries to log in at https://falcon.crowdstrike.com and is bounced to a "tenant not found" page. What is the MOST LIKELY cause?

   • A. The admin must access the EU-1 console URL (falcon.eu-1.crowdstrike.com) — Falcon URLs are cloud-region specific
   • B. The admin's account needs MFA enabled first
   • C. EU-1 requires VPN access from CrowdStrike's on-prem gateway
   • D. The browser is missing the Falcon root CA
   Show answer

   Correct: A. Each Falcon cloud (US-1, US-2, EU-1, US-GOV-1) has its own console FQDN. Logging into the wrong cloud returns "tenant not found". MFA and CA trust are unrelated. There is no on-prem gateway for SaaS Falcon. Always confirm the tenant's cloud region before sharing console URLs.

2. You are asked to give a junior analyst the ability to view detections and run RTR sessions, but NOT change prevention policies. The BEST built-in role to assign is:

   • A. Falcon Administrator
   • B. Endpoint Manager
   • C. Falcon Analyst + Real Time Responder
   • D. Falcon Investigator (read-only)
   Show answer

   Correct: C. Falcon Administrator can change everything (too much). Endpoint Manager focuses on sensor/host config but not detection triage. Falcon Investigator is read-only and CANNOT run RTR. The correct combination is Falcon Analyst (triage detections) + Real Time Responder (active session privileges). Role stacking like this is the recommended least-privilege pattern.

3. Which TWO statements about CrowdStrike Falcon cloud regions are CORRECT? (Choose 2)

   • A. Tenant data is replicated across all four commercial clouds for resilience
   • B. Each cloud region has an independent API base URL (e.g., api.crowdstrike.com vs api.eu-1.crowdstrike.com)
   • C. The US-GOV-1 cloud is FedRAMP-authorized and physically isolated from commercial tenants
   • D. Customers can migrate a tenant between regions via the Falcon console themselves
   • E. Sensor installers are identical across regions — region selection happens at first connect
   Show answer

   Correct: B and C. Tenants live in ONE region — no cross-cloud replication. Each cloud has its own API host. US-GOV-1 is FedRAMP-isolated. Migrations are a CrowdStrike-side operation (not self-service). Sensor installers are CID-bound; CID encodes the cloud, so the wrong installer cannot connect.

4. A customer wants programmatic access for a SOAR integration. What is the MINIMUM credential set needed?

   • A. A username/password and MFA token cached for 24 hours
   • B. A Falcon API Client (Client ID + Client Secret) with the specific scopes the SOAR needs (e.g., detects:read, hosts:write)
   • C. The CID and a Customer Workflow token
   • D. A signed JWT issued by the Falcon Administrator role
   Show answer

   Correct: B. Programmatic access uses API Clients created under Support and Resources → API Clients and Keys. Each client gets a Client ID + Secret and a tightly scoped set of permissions. Falcon does NOT support service-account user/password for API. Never reuse a human admin login for automation.

5. The Activity > Detections page shows a detection with severity "High". Where in the console do you confirm WHICH prevention policy the host was on when the detection fired?

   • A. Detection Details → Execution Details → "Policy assigned at time of detection"
   • B. Host Setup and Management → Sensor Update Policies
   • C. Configuration → Response Policies
   • D. Investigate → Host Search
   Show answer

   Correct: A. The Detection Details panel records the prevention policy active on the host at execution time — critical for post-incident verification ("was the host actually getting our hardened policy?"). Sensor Update Policies control versioning, not detection. Response Policies are for RTR command sets. Host Search shows current assignment, not historical.

Last updated: 2026-10-19

CCFA practice test FAQ