Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by CrowdStrike
Exam Format
Registration
Validity
CCFA Exam Topics and Domains
CCFA is organized into 8 weighted domains. Expect to work with Host Management, Falcon Console, Falcon Sensor, Audit Logs, and more.
User Management
Determine roles required for access to features and functionality
Determine roles required for access to features and functionality in the Falcon console
Create roles and assign users to roles
Create roles and assign users to roles based on desired permissions
Manage API keys
Manage API keys
Sensor Deployment
Prerequisites for Falcon sensor installation
Determine prerequisites to successfully install a Falcon sensor on supported operating systems
Default policies and best practices
Analyze the default policies and apply the best practices to prepare workloads for the Falcon sensor
Sensor uninstallation
Uninstall a sensor
Sensor troubleshooting
Troubleshoot a sensor
Host Management and Setup
Filtering in Host Management
Understand how filtering might be used in the Host Management page
Disable detections for a host
Disable detections for a host
Impact of disabling detections
Explain the effect of disabling detections on a host
Reduced Functionality Mode (RFM)
Explain the impact of Reduced Functionality Mode (RFM) and why it might be caused
Find hosts in RFM
Find hosts in RFM
Locate inactive sensors
Locate inactive sensors
Inactive sensor retention
Recall how long inactive sensors are retained
Host management reports
Determine relevant reports specific to host management
Group Creation
Group assignment for endpoints
Determine the appropriate group assignment for endpoints and understand how this impacts the application of policies
Best practices for host groups
Apply best practices when managing host groups
Policy Application
Prevention policy settings
Determine the appropriate prevention policy settings for endpoints and explain how this impacts security posture
Sensor update policy
Determine the appropriate sensor update policy settings in order to control the update process
RTR audit logs
Apply roles and policy settings, and track and review Falcon RTR audit logs in order to manage user activity
Containment policy functionality
Understand the functionality of a containment policy
Containment exclusions
Configure a containment policy for IP address or subnet exclusions that will apply to network contained hosts based on security workflow requirements
Quarantined files management
Understand options and requirements to manage quarantined files
Rules Configuration
Custom IOA rules
Create custom IOA rules to monitor for behavior that is not fundamentally malicious
Business requirements interpretation
Interpret business requirements in order to allow trusted activity, resolve false positives and fix performance issues
IOC settings
Assess IOC settings required for customized security posturing and to manage false positives
General Settings for CID management
Understand configurations for CID wide management within General Settings
Dashboards and Reports
Sensor reports
Understand the different types of sensor reports and their use cases
Audit logs
Understand the different audit logs and their use cases
Workflows
Workflow configuration
Configure workflows to respond to defined triggers
How do I earn this certification?
Passing CCFA earns the CrowdStrike Certified Falcon Administrator certification. It sits in the Falcon Platform track.
- CCFH - CrowdStrike Certified Falcon Hunter
- CCSE - CrowdStrike Certified SIEM Engineer
- CCFR - CrowdStrike Certified Falcon ResponderFront-line analyst responding to detections
- CCIS - CrowdStrike Certified Identity Specialist Identity and access management focus
- CCCS - CrowdStrike Certified Cloud Specialist Cloud infrastructure security specialization
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for CCFA is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
- ACTIVE
- Last content update: 2024-08-01
- Charlotte AI 2024 Release Likely to be included in future CCFA exam updates • Release date: 2024-09-17
- Project Kestrel Initial Release May change host management and dashboard topics • Release date: 2024-09-17
- CrowdStrike Signal 1.0 New event correlation capabilities to understand • Release date: 2024-09-16
- AI-Generated Parsers Next-Gen SIEM Relevant for CCSE certification, less for CCFA • Release date: 2024-09-15
Who should take this exam?
This exam is typically taken by Falcon platform administrators and Security analysts with administrative access.
- At least 6 months of experience working with CrowdStrike Falcon in a production environment
- Understanding of user management and role-based permissions
- Experience deploying and managing Falcon sensors
- Knowledge of policy configuration and group management
- Familiarity with administrative reporting