5.3 Identify Deployment Misconfigurations CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   A CrowdStrike administrator is reviewing the Falcon console and notices that a group of Windows servers is not receiving prevention policy updates. The sensors are online and reporting. Which deployment misconfiguration is the most likely cause?

   • AThe servers have been placed in reduced functionality mode by the administrator.
   • BThe servers are assigned to a sensor group that is not linked to the intended prevention policy.
   • CThe servers have the Windows Firewall enabled.
   • DThe servers are running an unsupported version of Windows.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst discovers that a group of production servers has been assigned to a sensor group with a prevention policy that has 'Execution of Suspicious Files' set to 'Detect Only' instead of 'Prevent'. What is the most immediate security impact of this misconfiguration?

   • AThe servers will automatically update the policy to 'Prevent' after a short delay to maintain protection.
   • BThe servers will be quarantined from the network to prevent further spread of the suspicious file.
   • CMalicious files will be allowed to execute, but the activity will be logged and visible in the console.
   • DThe servers will not generate any detection events for suspicious file executions.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is deploying the Falcon sensor to a fleet of 1,000 endpoints. They use a deployment script that includes the CID and a sensor group ID. After deployment, they find that 100 endpoints are in the 'Ungrouped' group. What is the most likely cause?

   • AThe 100 endpoints were installed with a different CID, so they are in a different tenant.
   • BThe 100 endpoints have a different operating system that does not support sensor grouping.
   • CThe sensor group was full, so the sensor could not be added.
   • DThe sensor group ID in the script was incorrect or expired, so the sensor could not join the group.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a large environment with 10,000 endpoints. They use CrowdStrike Falcon and have a policy that requires all endpoints to have the sensor installed. During a routine audit, they find that 500 endpoints do not have the sensor installed. What is the most likely cause?

   • AThe endpoints have a different operating system that is not compatible with the sensor installer used.
   • BThe deployment script failed to install the sensor on those endpoints due to a missing dependency or permission issue.
   • CThe endpoints are not supported by the Falcon sensor, so they were skipped during deployment.
   • DThe endpoints were intentionally excluded from the deployment because they are in a different network segment.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing the Falcon console and sees that a group of servers has a prevention policy with 'Ransomware' set to 'Detect Only'. The company's security policy requires 'Prevent' for all servers. What is the most appropriate remediation?

   • ACreate a new sensor group and move the servers to it, then apply a new policy with 'Prevent'.
   • BChange the 'Ransomware' setting in the prevention policy to 'Prevent' for the affected sensor group.
   • CUse the Falcon console to send a one-time command to each server to enable 'Prevent'.
   • DReinstall the sensor on each server with a new installer that includes the 'Prevent' setting.
   Reveal Solution Discussion Select an answer first