5.3 Identify Deployment Misconfigurations CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   A sensor was installed with the wrong CID, so the host is not visible in the correct Falcon console. What is the correct remediation step?

   • AContact the cloud provider to change the VM's metadata.
   • BModify the sensor's local configuration file to update the CID without reinstalling.
   • CChange the host's hostname to match the expected naming convention.
   • DReinstall the sensor with the correct CID using the installation command or script provided by the correct tenant.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a multi-tenant CrowdStrike Falcon environment with separate CIDs for different business units. A security administrator is deploying sensors to new servers and accidentally uses the wrong CID for one business unit. What is the most likely impact?

   • AThe servers will appear in the wrong tenant, and the security team for the correct business unit will not see them.
   • BThe servers will be protected, but the sensor will not receive policy updates because the CID is incorrect.
   • CThe servers will not be protected because the sensor will fail to install with an incorrect CID.
   • DThe servers will be protected, but the security team will not be able to manage them because the CID is incorrect.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team is deploying the Falcon sensor to a new set of servers. They use a configuration file that includes the CID and the sensor group ID. After deployment, they notice that the servers are not appearing in the expected sensor group. What is the most likely cause?

   • AThe servers are in a different time zone, causing the group assignment to be delayed.
   • BThe servers are not supported by the sensor version, so they could not join the group.
   • CThe sensor group ID was correct, but the servers were not assigned to the group because of a network issue.
   • DThe configuration file was corrupted, so the sensor could not read the group ID.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company has a group of servers that are supposed to have the 'High' prevention policy, but they are currently assigned to a group with the 'Medium' policy. The security team wants to remediate this without disrupting the servers. What is the recommended action?

   • AChange the policy assignment of the sensor group to 'High'.
   • BCreate a new sensor group with the 'High' policy and manually move each server to it.
   • CReinstall the sensor on each server with a new installer that specifies the 'High' policy.
   • DUse the Falcon console to push the 'High' policy directly to each server individually.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is using CrowdStrike Falcon to protect a fleet of laptops. They notice that some laptops are not reporting to the console after a recent network change. The laptops are able to reach the internet. What is the most likely cause?

   • AThe laptops are in a different time zone, causing the sensor to miss the reporting window.
   • BThe laptops have a different operating system version that is not supported by the sensor.
   • CThe laptops are not able to reach the CrowdStrike cloud due to a firewall rule blocking the sensor's communication port.
   • DThe laptops have been assigned to a sensor group that has 'Reporting' disabled.
   Reveal Solution Discussion Select an answer first