The CrowdStrike Certified Falcon Administrator (CCFA) certification validates your ability to run the Falcon platform day to day: users, sensor deployment, groups, policies, rules and reporting. This two-day preparation follows the eight areas of CrowdStrike's certification guide, mixing demonstrations, practical cases and practice questions.
Organise hosts into groups and apply policies to them
Configure rules and exclusions in a controlled way
Use dashboards, reports and workflows
Program
Users and access
User and role management
Sensors and hosts
Sensor deployment
Host management and setup
Groups, policies and rules
Group creation
Policy application
Rules configuration
Reporting and automation
Dashboards and reports
Workflows
Exam practice questions
Prerequisites
At least six months of hands-on Falcon experience, as recommended by CrowdStrike
Windows, macOS or Linux administration basics
Endpoint security fundamentals
Target audience
CrowdStrike Falcon platform administrators
Security and SOC teams managing EDR sensors
Integrators and managed service providers
The exam
The CCFA exam has 60 questions in 90 minutes. It is taken in English through Pearson VUE, online (OnVUE) or at a test centre. The certification is valid for three years; to renew it, you pass the current version of the exam. After a failed attempt, there is a 48-hour wait before the second attempt and seven days before the third.
Preparation tips
Practise on a real or test Falcon console
Review the eight areas of the CCFA certification guide
Understand how policies and groups take precedence
Frequently asked questions (FAQ)
How long is CCFA valid?
Three years. You renew it by passing the current version of the exam.
Is the exam available in French?
No, the exam is offered in English. CrowdStrike states it is suitable for non-native English speakers.
How do I get a voucher?
Vouchers are obtained from CrowdStrike, including through your account executive. We can point you in the right direction.
Which course formats?
Live online, in person in Casablanca or on-site at your organization, in French or English.