thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

CrowdStrike · Cybersecurity · Associate

CrowdStrike Certified Falcon Administrator (CCFA) exam guide

Exam CCFA

The CrowdStrike Certified Falcon Administrator (CCFA) validates the ability to deploy and administer the CrowdStrike Falcon platform: sensor deployment, prevention policies, host management, user roles and reporting. Falcon is a leading EDR/XDR platform, so CCFA is useful for endpoint security engineers.

QuestionsSee official page
Time limitSee official page
Passing scoreSee official page
Exam feeSee official page
Valid forSee official page
DeliveryPearson VUE (confirm with CrowdStrike)

Format: Multiple choice. Fee note: Confirm on CrowdStrike University.

Who it's for

Security engineers and administrators who manage CrowdStrike Falcon deployments.

What the exam covers

The vendor does not publish a domain breakdown for this exam. Check the official exam page for the current objectives.

Eligibility & prerequisites

Required: Check CrowdStrike University for current requirements.

Recommended: Hands-on Falcon administration and the CrowdStrike University Falcon administration training.

Keeping it active

Check CrowdStrike University for current validity and recertification rules.

Skills & careers

Skills it validates

  • Sensor deployment and updates
  • Prevention and response policies
  • Host groups and management
  • User roles and RBAC
  • Exclusions and tuning
  • Dashboards and reporting

Job roles

Endpoint Security EngineerEDR AdministratorSOC EngineerSecurity AdministratorSecurity Operations Analyst

Where it fits in your path

Take before

CompTIA Security+

You are here

CrowdStrike Certified Falcon Administrator (CCFA)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Complete CrowdStrike University Falcon admin training.
  2. Week 2: Practice in a Falcon tenant: policies, host groups.
  3. Week 3: Exclusions, RBAC and reporting.
  4. Week 4: Review and practice.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know policy precedence across host groups.
  • Understand sensor update policies.
  • Learn exclusion types and risks.
  • Review RBAC roles.

Key terms for this exam

All 9 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

What does CCFA cover?

Falcon platform administration.

How much does it cost?

Confirm on CrowdStrike University.

Is training required?

Check CrowdStrike University.

Is it worth it?

Yes if your organization runs Falcon.

What next?

CrowdStrike responder/hunter certifications or CySA+.

Official page: www.crowdstrike.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.