Question bank
CrowdStrike Certified Falcon Practitioner
40 CrowdStrike Certified Falcon Practitioner questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Endpoint Security
12 questions in this domain
- Question 1Single Choice
What mathematical approach does CrowdAV use to evaluate file characteristics and behavior?
- AAdvanced mathematical modelsCorrect answer
- BStatic hash comparisons
- CUser login history
- DNetwork packet signatures
Why this is the answer
CrowdAV uses advanced mathematical models to analyze file characteristics and behavior, enabling ML-based detection.
- Question 2Multiple Select
Which two machine learning layers does Falcon use to protect against new malware variants?
- ASensor-based MLCorrect answer
- BCloud-based MLCorrect answer
- CHeuristic ML
- DSignature-based ML
Why this is the answer
Falcon combines Sensor-based ML on the endpoint and Cloud-based ML in the cloud to provide layered defense.
- Question 3Interactive
Based on the configuration in the code block, what ML mode is applied to the Finance host group?
- ADetectionCorrect answer
- BPrevention
- CAggressive
- DDisabled
Why this is the answer
The snippet shows that the Finance host group has its ML policy mode set to Detection, not Prevention.
- Question 4Single Choice
What does Behavioral Blocking monitor instead of relying on a specific file?
- AProcess actions and sequencesCorrect answer
- BFile hashes
- CIP addresses
- DUsernames
Why this is the answer
Behavioral Blocking examines suspicious sequences of process actions, enabling prevention of fileless attacks.
- Question 5Multiple Select
Which two of the following are Indicators of Attack (IOAs)?
- ACredential dumping behaviorCorrect answer
- BUnauthorized encryption attemptsCorrect answer
- CStatic file hashes
- DVirus signatures
Why this is the answer
IOAs focus on behavior, such as credential dumping or unauthorized encryption, rather than static artifacts.
- Question 6Interactive
Based on the code block, which two exclusion types are configured?
- APathCorrect answer
- BProcessCorrect answer
- CFile hash
- DNetwork IP
Why this is the answer
The configuration defines a path exclusion and a process exclusion to prevent false positives.
- Question 7Single Choice
What happens when a Falcon sensor is set to Detection mode?
- AThe action is logged but allowed to completeCorrect answer
- BThe action is blocked before execution
- CThe sensor stops collecting telemetry
- DThe endpoint is immediately isolated
Why this is the answer
Detection mode records the threat and allows the action to complete, while Prevention mode actively blocks it.
- Question 8Multiple Select
Which three types of activity does EDR visibility monitor besides file changes?
- AProcess activityCorrect answer
- BNetwork connectionsCorrect answer
- CRegistry modificationsCorrect answer
- DCPU temperature
Why this is the answer
EDR visibility includes process, network, and registry activity, not just file modifications.
- Question 9Interactive
What deployment strategy does the sensor update policy in the code block represent?
- ARing deploymentCorrect answer
- BManual patch
- CDisabled updates
- DGlobal rollback
Why this is the answer
The policy uses rings to test new sensor versions on subsets before broader rollouts.
- Question 10Single Choice
Which policy type manages the lifecycle and versioning of the Falcon agent?
- ASensor Update PolicyCorrect answer
- BPrevention Policy
- CDetection Policy
- DHost Group Policy
Why this is the answer
Sensor Update Policies manage Falcon agent lifecycle, versioning, and deployment rings.
- Question 11Multiple Select
Which two common ML tuning mistakes are highlighted in the playbook?
- ASetting Extra Aggressive on all assetsCorrect answer
- BApplying broad exclusions for one false positiveCorrect answer
- CEnabling real-time telemetry
- DUsing host groups for assignment
Why this is the answer
Overly aggressive ML settings and broad exclusions can cause instability or create security blind spots.
- Question 12Interactive
Which two telemetry types are enabled in the code block?
- AProcess activityCorrect answer
- BNetwork connectionsCorrect answer
- CRegistry modifications
- DFile integrity
Why this is the answer
The snippet enables process and network telemetry while keeping registry and file integrity disabled.
Platform Fundamentals
12 questions in this domain
- Question 13Single Choice
What does CrowdAV primarily use to evaluate file characteristics and behavior?
- AAdvanced mathematical modelsCorrect answer
- BStatic hash lookup
- CManual signature definitions
- DSimply blocking all new files
Why this is the answer
CrowdAV uses advanced mathematical models to analyze file characteristics and behavior, avoiding reliance on static hashes or signatures.
- Question 14Multiple Select
Which two ML layers does Falcon combine to provide defense-in-depth against new malware variants?
- ASensor-based ML (on-endpoint)Correct answer
- BCloud-based ML (in-flight)Correct answer
- CBehavioral Blocking
- DIOC matching
Why this is the answer
Falcon uses both sensor-based on-endpoint ML and cloud-based in-flight ML, creating defense-in-depth for novel malware.
- Question 15Interactive
Review the policy snippet. What will the Falcon sensor do when the machine learning mode is set as shown?
- ALog the event but allow the action to completeCorrect answer
- BImmediately kill the process
- CQuarantine the file without logging
- DStop collecting telemetry
Why this is the answer
In Detection mode the sensor logs the event but allows the action to complete; Prevention mode is needed to stop it.
- Question 16Single Choice
When using Behavioral Blocking, what does the protection focus on?
- AThe 'what': suspicious sequences of actionsCorrect answer
- BThe 'who': user identity
- CStatic file hashes
- DNetwork IP reputation
Why this is the answer
Behavioral Blocking focuses on the 'what'—suspicious sequences of actions—rather than file identity or user identity.
- Question 17Multiple Select
Which two behaviors would Behavioral Blocking most likely flag as suspicious?
- AProcess attempting to inject code into memoryCorrect answer
- BUnusual PowerShell execution patternCorrect answer
- CA normal scheduled backup
- DA user changing their password
Why this is the answer
Behavioral Blocking targets suspicious actions like memory injection and unusual PowerShell patterns, while ignoring benign administrative activity.
- Question 18Interactive
Review the exclusion configuration. What is the primary risk associated with this broad global exclusion?
- AIt creates massive security blind spotsCorrect answer
- BIt improves endpoint performance dramatically
- CIt strengthens ML detection
- DIt removes the sensor from hosts
Why this is the answer
A broad global exclusion creates security blind spots, as attackers can operate in excluded paths or processes without protection.
- Question 19Single Choice
In the Falcon console, what does selecting 'Detection' for ML prevention mean for the sensor's response?
- AThe threat is noted but the action is allowed to completeCorrect answer
- BThe process is terminated before completion
- CThe file is quarantined automatically
- DThe endpoint is isolated immediately
Why this is the answer
Detection mode means the threat is noted but its action is allowed to complete; actual protection requires Prevention mode.
- Question 20Multiple Select
Which two statements describe how Falcon sensor telemetry is collected?
- AIt captures granular data from the kernel levelCorrect answer
- BIt does not interrupt user workflowsCorrect answer
- CIt only records data after an alert fires
- DIt relies on the central console to poll the host
Why this is the answer
The Falcon sensor captures kernel-level telemetry continuously without interrupting workflows, providing data for retrospective analysis.
- Question 21Interactive
Review the process tree. What does the parent-child relationship shown indicate to an analyst?
- AA classic indicator of exploitationCorrect answer
- BNormal system administration activity
- CA false positive from the sensor
- DEvidence of machine learning training
Why this is the answer
A host process like Outlook spawning a command shell is a classic indicator of exploitation and requires investigation.
- Question 22Single Choice
Instead of static hashes, what does Falcon EDR primarily use to identify malicious intent?
- AIndicators of Attack (IOAs)Correct answer
- BIndicators of Compromise (IOCs)
- CFile extension filters
- DApplication allowlists
Why this is the answer
Falcon EDR prioritizes IOAs, which focus on behavioral 'how', over static IOCs such as hashes.
- Question 23Multiple Select
Which two activities are examples of Indicators of Attack (IOAs) that EDR monitors?
- ACredential dumpingCorrect answer
- BUnauthorized encryption attemptsCorrect answer
- CA known malware hash
- DAn application version string
Why this is the answer
IOAs represent behaviors like credential dumping and unauthorized encryption, even when the tools used are legitimate.
- Question 24Interactive
Review the event timeline. What does incident reconstruction primarily enable an analyst to determine?
- ARoot cause, scope, and impacted assetsCorrect answer
- BThe future malware variants
- CThe exact OS patch version
- DThe identity of all network users
Why this is the answer
Incident reconstruction weaves telemetry into a timeline to determine root cause, scope, and impacted assets.
Response & Investigation
8 questions in this domain
- Question 25Single Choice
Which Falcon technology uses advanced mathematical models to analyze file characteristics and behavior?
- AMachine Learning (ML) modelsCorrect answer
- BBehavioral Blocking
- CSensor Update Policies
- DHost Group assignments
Why this is the answer
CrowdAV uses ML models to analyze file characteristics and behavior. Behavioral blocking focuses on process actions, not file attributes.
- Question 26Multiple Select
Which two statements correctly describe Sensor-based ML and Cloud-based ML in Falcon?
- ASensor-based ML runs locally on the endpoint.Correct answer
- BCloud-based ML only inspects files after they have already been executed.
- CCloud-based ML runs in-flight and can detect novel variants.Correct answer
- DCloud-based ML replaces the need for sensor-based ML.
Why this is the answer
Sensor-based ML is on the endpoint, while cloud-based ML operates in-flight. Both layers are needed for defense-in-depth against novel malware.
- Question 27Interactive
Review the policy excerpt in the code block. What will the Falcon sensor do when it encounters a suspicious file with ML configured to 'Detection'?
- AIt will log the detection and allow the action to complete.Correct answer
- BIt will immediately block the file from executing.
- CIt will terminate the process because behavioral blocking is enabled.
- DIt will quarantine the file and roll back registry changes.
Why this is the answer
Detection mode means the threat is noted but the action is allowed to complete. The code block also has behavioral blocking disabled.
- Question 28Single Choice
What fundamental difference separates Behavioral Blocking from ML detection in CrowdStrike Falcon?
- ABehavioral Blocking examines process actions; ML examines file attributes.Correct answer
- BBehavioral Blocking uses static hashes; ML uses process trees.
- CML monitors network connections; Behavioral Blocking monitors file content.
- DML is only cloud-based; Behavioral Blocking is only on the endpoint.
Why this is the answer
This is a common trap. ML focuses on file attributes and characteristics, while Behavioral Blocking focuses on suspicious sequences of process actions.
- Question 29Multiple Select
Which two examples best represent Behavioral Blocking rather than static file detection?
- AA process attempts to inject code into memory.Correct answer
- BAn unusual PowerShell execution pattern is observed.Correct answer
- CA file matches a known malware hash.
- DA downloaded file has a clearly malicious static signature.
Why this is the answer
Behavioral blocking focuses on the 'what' or the action, such as code injection and unusual PowerShell patterns, rather than static file attributes or hashes.
- Question 30Interactive
The exclusion shown in the code block was created for a single false positive. Why is this configuration risky?
- AIt applies a broad exclusion that could create a blind spot for attackers.Correct answer
- BIt excludes only a specific path and process.
- CIt increases ML aggressiveness for all files.
- DIt overrides the Sensor Update Policy ring.
Why this is the answer
Exclusions should be surgical and scoped to a specific path or process. A broad wildcard exclusion can create major security blind spots.
- Question 31Single Choice
What does 'Detection' mode mean in a Falcon prevention policy?
- AThe sensor logs the event and allows the action to complete.Correct answer
- BThe sensor kills the process before the action completes.
- CThe sensor blocks the file and rolls back changes.
- DThe sensor ignores the event and sends no telemetry.
Why this is the answer
Detection mode implies the threat is noted but the action is allowed to complete. Prevention mode is required to actively block or kill the activity.
- Question 32Multiple Select
Which two elements are key to process tree visualization in Falcon EDR?
- AParent-child process relationships.Correct answer
- BMalicious lineage such as a browser spawning a command shell.Correct answer
- CStatic file hashes from known malware.
- DFile exclusion lists from prevention policies.
Why this is the answer
Process tree visualization focuses on parent-child execution relationships and helps identify malicious lineage such as a browser spawning a shell.
Threat Intelligence
8 questions in this domain
- Question 33Single Choice
In the CrowdAV machine learning framework, which two layers of ML models provide defense-in-depth against novel malware variants?
- ASensor-based ML and Cloud-based MLCorrect answer
- BStatic ML and Dynamic ML
- CPrevention ML and Detection ML
- DBehavioral ML and Reputation ML
Why this is the answer
CrowdAV combines sensor-based ML on the endpoint with cloud-based ML in flight, giving layered protection against new and unknown malware.
- Question 34Multiple Select
Which of the following are examples of suspicious sequences that Behavioral Blocking monitors?
- AProcess injecting code into memoryCorrect answer
- BUnusual PowerShell execution patternCorrect answer
- CKnown malware file hash match
- DSigned executable running normally
Why this is the answer
Behavioral Blocking monitors process actions such as memory injection and unusual PowerShell usage, so it can prevent fileless attacks without relying on static file hashes.
- Question 35Interactive
Review the endpoint telemetry excerpt. Which Falcon concept best explains why the event is suspicious?
- AParent-child process lineage indicates exploit chainCorrect answer
- BStatic file hash matches known malware
- CRemote connection to a C2 IP address
- DRegistry modification for persistence
Why this is the answer
A document processor spawning PowerShell is classic malicious lineage; EDR reconstructs parent-child relationships to reveal exploitation.
- Question 36Single Choice
In Falcon prevention policy tuning, what is the operational difference between 'Detection Only' and 'Prevention' modes?
- ADetection logs; Prevention actively terminatesCorrect answer
- BDetection uses cloud ML; Prevention uses sensor ML
- CDetection applies to servers; Prevention to workstations
- DDetection blocks fileless attacks; Prevention blocks only files
Why this is the answer
In Detection mode the sensor records the activity but allows it to complete; in Prevention mode the sensor actively kills the process.
- Question 37Multiple Select
Which exclusion practices align with disciplined NGAV management?
- AConfigure file, path, or process exclusionsCorrect answer
- BUse broad global exclusions for a single false positive
- CApply surgical path/process-specific exclusionsCorrect answer
- DExclude entire drives to reduce support tickets
Why this is the answer
Disciplined exclusion management uses targeted file, path, or process exclusions to avoid false positives; broad exclusions create attacker bypasses.
- Question 38Interactive
Review the telemetry event. Which type of endpoint visibility does this event best illustrate?
- ANetwork Connection MappingCorrect answer
- BProcess Tree Visualization
- CRegistry and File Integrity
- DKernel memory scanning
Why this is the answer
This excerpt captures connection metadata and correlates it with a process, enabling command-and-control and data exfiltration visibility.
- Question 39Single Choice
How does the Falcon sensor collect continuous telemetry without disrupting user workflows?
- AIt captures granular data at the kernel levelCorrect answer
- BIt depends on scheduled full-disk scans
- CIt requires central console polling
- DIt captures events only during alerts
Why this is the answer
The Falcon sensor captures granular data from the kernel level in real time, so retrospective analysis is possible without interrupting user workflows.
- Question 40Multiple Select
Which of the following are considered Indicators of Attack (IOAs) in EDR?
- ACredential dumping attemptsCorrect answer
- BUnauthorized encryption processesCorrect answer
- CKnown malicious file hash
- DStatic IP address reputation
Why this is the answer
IOAs focus on how an attack happens, such as credential dumping and unauthorized encryption, not static artifacts like hashes or IPs.
Frequently asked questions
Everything about the CrowdStrike Certified Falcon Practitioner question bank and how to use it.