CrowdStrike Certified Falcon Administrator

The CrowdStrike Certified Falcon Administrator (CCFA) exam is the assessment behind CrowdStrike’s administrator credential for the Falcon platform. It is aimed at security administrators, SOC analysts, security engineers and anyone with access to the administrative side of a Falcon console. Passing it shows you can manage users, deploy sensors, apply policies and configure rules in a live environment. This page collects the official details so you can plan your preparation with accurate information.

What the CCFA Exam Validates

CrowdStrike positions the CCFA as the credential for people who run the Falcon platform day to day, as opposed to people who investigate what it finds. That difference matters. The exam focuses on configuration and management: who gets access, how sensors reach endpoints, which policies apply to which hosts, and how trusted activity is handled without weakening protection.

According to the official exam guide, a successful candidate understands user management and role based permissions, deploys and manages Falcon sensors, configures prevention and deployment policy settings, sets up allowlists and blocklists, configures file path exclusions, and produces administrative reports.

CCFA sits in the same certification program as the Falcon Responder (CCFR) and Falcon Hunter (CCFH) credentials. Those two focus on detection response and proactive hunting, while the CCFA centers on keeping the platform correctly configured.

Eligibility and Recommended Experience

CrowdStrike does not require another certification before the CCFA. The official requirements for every registrant are to accept the CrowdStrike Certification Exam Agreement, be at least 18 years old, and purchase an exam voucher.

The guide also recommends at least six months of experience with Falcon in a production environment. This is a recommendation, not a gate, but it is  advice because many questions assume you have worked in the console. CrowdStrike additionally recommends having access to CrowdStrike University and completing its Falcon Administrator courses, which are the official learning path for this exam.

Candidates should be able to read English with enough accuracy and fluency to follow the questions. CrowdStrike notes that the exams are suitable for non native English speakers.

Exam Structure and Format

The CCFA is a 60 question assessment with a 90 minute time limit, which averages out to about a minute and a half per question. CrowdStrike describes it as a closed book exam, so you cannot use documentation while testing. Exams are delivered through Pearson, and candidates can view their official score report there after results post.

The official guide does not publish a passing score. Third party sites quote figures ranging from 70 percent to 80 percent, and they do not agree with each other, so treat any specific number as unconfirmed until you see it in your Pearson candidate materials.

Syllabus and Domain Breakdown

The official guide lists eight areas of exam scope. It does not publish percentage weightings, so be cautious about sites that do. The guide also states that other related topics may appear on any specific delivery of the exam.

1. User Management: choosing roles for access to console features, creating roles and assigning users, and managing API keys.

2. Sensor Deployment: installation prerequisites on supported operating systems, applying best practices to prepare workloads, uninstalling sensors, and troubleshooting.

3. Host Management and Setup: filtering in Host Management, disabling detections for a host and its effects, Reduced Functionality Mode (RFM), locating inactive sensors, and how long inactive sensors are retained.

4. Group Creation: assigning endpoints to the right groups and understanding how that affects which policies apply.

5. Policy Application: prevention policy settings, sensor update policies, containment policies, quarantined file management, and  Time Response audit logs.

6. Rules Configuration: custom IOA rules, allowing trusted activity, resolving false positives, IOC settings, and CID wide settings.

7. Dashboards and Reports: sensor reports and audit logs, and when to use each.

8. Workflows: configuring workflows that respond to defined triggers.

Retake Policy

If you do not pass on your first attempt, you must wait 48 hours before trying again. After the second attempt, the wait becomes seven days for the third and any later attempt. Retakes beyond the fourth attempt are handled case by case, and CrowdStrike can deny them. A candidate who fails a fourth time through their own performance must wait 30 days and retake the recommended training before being cleared for a fifth attempt. You cannot retake an exam you have already passed unless it is part of an approved recertification.

Registration Process

You need a CrowdStrike exam voucher to register. The official guide says to contact your CrowdStrike Account Executive for a quote or to purchase a voucher through Pearson. Because pricing, voucher terms and delivery options can change, confirm the current fee and scheduling steps with CrowdStrike or Pearson before you book. If you believe a question is invalid, you can email [email protected] within three days of testing.

Certification Validity and Recertification

All CrowdStrike certifications are valid for three years from the date you pass. To recertify, you pass the most current version of the exam once your certification expires. Since CrowdStrike updates exam versions over time, your renewal exam may differ from the one you first sat.

Career Value

Falcon is widely deployed as an endpoint protection platform, and organizations that run it need people who can configure it correctly. Roles where the CCFA is directly relevant include Falcon administrator, endpoint security engineer, security operations engineer and IT security operations manager, all of which CrowdStrike names as typical audiences.

The credential carries the most weight when paired with  console experience, because employers hiring for Falcon work care about whether you can handle sensor troubleshooting, exclusion scoping and policy inheritance without supervision. It also works as a foundation: many candidates move on to the Responder or Hunter credentials afterward.

Preparing with AllExamQuestions.com

Since the exam is closed book and scenario driven, practicing under timed conditions helps you get used to the pacing. Free practice tests on AllExamQuestions.com can help you find weak spots across the eight domains, such as policy application or RFM behavior, so you know where to spend your lab time. Pair them with the official CrowdStrike University courses and the support documentation the exam guide recommends.