What is the format of the CCFA exam?
The CrowdStrike Certified Falcon Administrator (CCFA) exam is a 90-minute, 60-question assessment - about 90 seconds per question. CrowdStrike's exam guide describes it as the final step toward the CCFA certification, evaluating whether you can perform administrative and vulnerability-management tasks inside the Falcon platform.
CrowdStrike does not publish a numeric passing score. The guide requires candidates to 'achieve a passing score' and leaves it there - any third party quoting an exact CCFA pass percentage is guessing.
Everything on this page comes from CrowdStrike's own exam guide and program guide, so you are reading the format the vendor actually publishes - not a forum's memory of it.
What topics does the CCFA exam cover?
The published exam scope has eight topic areas. They are administrative to the core - this is the credential for the person who runs the Falcon platform, not the person who only reads its detections.
CrowdStrike recommends at least six months of hands-on Falcon experience before sitting, because the questions measure skills gained through doing the work: deploying sensors across a real estate, tuning prevention policies without breaking the business, and pulling the administrative report a director asked for.
Notice what is not on that list: threat hunting, CQL query writing, and detection analysis. Those belong to CCFH. The CCFA scope is deliberately operational - the exam wants proof you can run the platform day to day, so preparation that ignores the console's administrative workflows leaves most of the eight areas exposed.
| # | Scope area | What it means in practice |
|---|---|---|
| 1 | User Management | Accounts, role-based permissions, who can touch what in the console |
| 2 | Sensor Deployment | Installing and managing Falcon sensors across endpoints |
| 3 | Host Management and Setup | Grouping and configuring the hosts you protect |
| 4 | Group Creation | Building the groups that policies and sensors attach to |
| 5 | Policy Application | Deployment and prevention policy settings that actually enforce |
| 6 | Rule Configuration | Allowlists, blocklists, and file-path exclusions |
| 7 | Dashboards and Reports | Administrative reporting leadership can read |
| 8 | Workflows | The operational flows tying the console together |
Scroll horizontally to view all columns.
How much does the CCFA exam cost?
$250 USD per exam, per the CrowdStrike Falcon Certification Program guide. The voucher is purchased through your CrowdStrike sales representative or online at Pearson, and every registrant must accept the CrowdStrike Certification Exam Agreement and be at least 18 years old.
Budget for the retake policy, not just the first sitting. A failed attempt is another full $250, plus a mandatory 48-hour wait before attempt two and a seven-day wait before attempt three and beyond. A fourth performance failure triggers a 30-day wait, retaken recommended training, and a review with the CrowdStrike Certification Manager before a fifth attempt is approved.
Can you take the CCFA exam at home?
Yes. Pearson VUE's CrowdStrike program page states the certification programs are 'delivered by Pearson either online (OnVUE) or at a Pearson Testing Center (PVTC)' - your room or theirs.
At home, OnVUE's published requirements apply: Windows 10 or macOS 14 or higher, a working webcam, microphone, and speaker with no headphones, one display only, at least 6 Mbps down and 2 Mbps up, and the ability to close every application except OnVUE. Virtual machines, phones, tablets, smart devices with recording or AI features, secondary displays, VPNs, and corporate or public networks are prohibited. Failing the requirements on exam day can mean immediate cancellation and forfeiture of the exam fee - run the system test on the exact device and network you will use.
How long does the CCFA certification last?
Three years. Every CrowdStrike certification is valid for three years from the date you pass, and recertification requires passing the most current version of the exam when it expires - CrowdStrike publishes no continuing-education shortcut.
You also cannot retake an exam you already passed except for an approved recertification, so the three-year clock is the only scheduled reason to see the exam again.
That three-year clock matters for planning. If your employer needs the credential for a contract or a role requirement, an expiring CCFA means facing the current version of the exam again - on the current format, not the one you originally passed. CrowdStrike's scope-change clause is explicit that exam content can change at any time without notice.
Where does CCFA sit in the ladder? It is the administrator credential - the operational counterpart to the hunter track (CCFH, built around detection work and CQL) and the cloud-security track (CCCS, built around Falcon cloud security posture). The same program guide governs all of them: $250 per exam, the same retake ladder, the same three-year validity. Administrators who later add CCFH or CCCS are stacking complementary scopes, not repeating one.
If the Sitting Itself Is the Problem
Format research solves the knowing. It does not solve the doing when your calendar, your test anxiety, or a failed attempt already on the books is the real blocker.
That is the gap Exam Assist fills: your CCFA sitting is handled end to end against the current 60-question, 90-minute format, and the service fee is due only after the agreed pass posts. If that is the outcome you actually need, the CCFA service page has the details.
Either way, you now know the real shape of the exam: 60 questions, 90 minutes, $250, eight administrative scope areas, at home or at a center. The next move is yours - book the sitting yourself, or hand it to a team whose fee only exists if the pass posts.