CrowdStrike Certified Falcon Administrator

CCFA · ● Active · Associate · CrowdStrike

Exam facts

Vendor source — CrowdStrike Education Services ↗
Official exam prep — CrowdStrike University CCFA ↗

About

The CCFA validates hands-on ability to deploy, configure, and manage the CrowdStrike Falcon platform in enterprise environments. Designed for security operations, systems administration, and IT teams responsible for endpoint detection and response (EDR) deployment and day-to-day administration. This is the entry-level associate certification in the CrowdStrike credential pathway and serves as the foundation for advanced CCFR (Responder) and CCFH (Hunter) specializations.

Domain context — Security/EDR

Endpoint Detection and Response (EDR) is the real-time telemetry and forensics layer that sits between antivirus (prevention) and SIEM (correlation). EDR platforms like Falcon prioritize visibility: they capture process trees, network flows, file operations, and memory execution to enable post-breach investigation and threat hunting. At the associate level, practitioners focus on operational administration: rolling out sensors to enterprise hosts, tuning prevention and detection policies, triaging alerts, and ensuring compliance requirements.

Read full deep dive — CrowdStrike Ecosystem →

Topics covered

• Falcon Console Navigation — Platform UI, menus, dashboards, information architecture
• User and Role Management — User provisioning, role assignment, permission models, RBAC
• Policy Configuration — Prevention policies, response policies, detection tuning, sensor grouping
• Sensor Deployment — Installation and provisioning strategies, deployment groups, Windows/Linux/macOS agents
• Host Management — Host onboarding, asset organization, grouping, tagging, host isolation
• Real Time Response Basics — Interactive endpoint access, common commands, response techniques
• Alert and Detection Triage — Alert classification, severity assessment, false-positive filtering, investigation workflows
• Indicator of Compromise (IOC) Management — Custom IOC creation, threat matching, rule application
• Falcon Insight Basics — Threat intelligence integration, detection logic, indicator matching
• Charlotte AI for Admins — AI-assisted platform navigation, configuration recommendations
• Falcon Reporting and Dashboards — Custom reporting, dashboard creation, compliance metrics, data export

Source: CrowdStrike University ↗

Common skills at Security/EDR · Associate

Shared content for the Security/EDR domain at Associate level — not specific to this cert.

• Host and endpoint reconnaissance
• System log analysis and correlation
• Alert triage and incident classification
• Security policy creation and enforcement
• Compliance reporting and audit readiness
• Threat intelligence and indicator matching
• Incident response containment procedures
• Windows/Linux/macOS administration fundamentals

Recommended courses at Security/EDR · Associate

Course-selection rule: CrowdStrike University is the official primary source. Vendor-provided courses are free with Falcon platform trial access. Third-party courses supplement but do not replace official materials.

Practice exams

Note: Limited third-party practice exam coverage exists for CCFA. The official practice assessment is the primary resource. Supplementary study focuses on hands-on console labs.

Books

No dedicated CCFA study guide book currently available. Official exam preparation relies on CrowdStrike University course materials, documentation, and hands-on Falcon Console labs. Students are directed to the Falcon Administration Guide (PDF) available through CrowdStrike's documentation portal.

Typical job titles at Security/EDR · Associate

SOC Analyst (Falcon) · EDR Engineer (CrowdStrike) · CrowdStrike Administrator · Cybersecurity Engineer (Endpoint) · Security Operations Specialist

(Job titles drawn from current job-board postings that list CrowdStrike Falcon or CCFA as required or preferred.)

Salary

Salary note: Salary data for CCFA-specific roles is limited; ranges reflect typical SOC Analyst and EDR Engineer salaries in each region. Final compensation depends on employer size, geography, experience, and adjacent skills (incident response, threat hunting, threat intelligence).

Skills validated

Cert-specific — what this exam actually tests.

• CrowdStrike Falcon Console administration and configuration
• Endpoint sensor deployment strategies and troubleshooting
• Host grouping and organizational hierarchy management
• Prevention and response policy design and application
• Real Time Response (RTR) interactive command execution
• Alert investigation and false-positive remediation
• Custom IOC creation and threat matching
• Falcon Insight threat intelligence integration
• Role-based access control (RBAC) provisioning
• Dashboard and compliance reporting
• Charlotte AI platform assistant navigation

Related certifications

• Stacks with: CrowdStrike Certified Falcon Responder (CCFR) ↗ · CrowdStrike Certified Falcon Hunter (CCFH) ↗
• Prerequisite for: CCFR (Responder), CCFH (Hunter) certifications
• Equivalents at this level: Palo Alto Networks Certified Associate Endpoint Security ↗ · Microsoft Certified: Cybersecurity Defender Associate ↗
• Vendor overview: CrowdStrike Vendor Overview ↗

Sources

• CrowdStrike Education Services: https://www.crowdstrike.com/services/education/
• CrowdStrike Falcon Platform Education: https://www.crowdstrike.com/services/education-services-falcon-platform/
• CrowdStrike University: https://www.crowdstrike.com/services/education-services-falcon-platform/
• Falcon Administration Guide (PDF): Available via CrowdStrike partner portal

Last verified: 2026-05-01
Parent ecosystem: CrowdStrike Ecosystem
Parent domain: Security/EDR Domain
Vendor overview: CrowdStrike Vendor Overview