5.3 Identify Deployment Misconfigurations CCCS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   A host is in a sensor group that is linked to a prevention policy with overly permissive settings. What is the best remediation step to align with CrowdStrike best practices?

   • AMove the host to a sensor group that is linked to a prevention policy with the appropriate security settings.
   • BIncrease the host's network bandwidth to improve sensor performance.
   • CChange the host's operating system to a more secure version.
   • DDisable the sensor on the host to avoid false positives.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a potential breach on a server that has the Falcon sensor installed. The analyst notices that the server is in a sensor group with a prevention policy that has 'Memory Protection' disabled. What is the most likely impact of this misconfiguration?

   • AThe server is more vulnerable to memory-based attacks, such as buffer overflows, because the sensor will not detect or prevent them.
   • BThe server is protected from memory-based attacks, but the sensor will not log them.
   • CThe server is protected from memory-based attacks, but the sensor will not report them to the console.
   • DThe server is not protected from any attacks because memory protection is a core feature of the sensor.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   An administrator discovers that a cloud connector was misconfigured, causing the Falcon console to not receive events from a cloud provider. What is the most direct security impact of this misconfiguration on runtime protection?

   • AThe organization will lose visibility into cloud-level events, such as API calls and resource changes, that could indicate an attack.
   • BThe cloud workloads will be automatically quarantined from the network.
   • CThe sensor will stop detecting malware on the affected cloud workloads.
   • DThe sensor will be unable to send telemetry to the Falcon cloud.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   A security analyst notices that a newly deployed Linux server is not appearing in the Falcon console's host inventory. The sensor package was installed and the service is running. Which deployment misconfiguration is the most likely cause?

   • AThe sensor is in reduced functionality mode due to low disk space.
   • BThe sensor was installed with the wrong CID (Customer ID) during installation.
   • CThe server's hostname contains uppercase letters.
   • DThe Falcon sensor was installed on a virtual machine without VMware Tools.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a group of servers that are not receiving the latest prevention policy updates. The security team suspects that the sensor group is misconfigured. They check the Falcon console and see that the group is assigned to the correct policy. What is the next step to troubleshoot this issue?

   • AReinstall the sensor on all servers in the group to ensure they receive the latest policy.
   • BContact CrowdStrike support to manually push the policy to the servers.
   • CVerify that the sensors in the group are online and communicating with the CrowdStrike cloud.
   • DCreate a new sensor group and move the servers to it, then assign the policy again.
   Reveal Solution Discussion Select an answer first