2.2 Analyze the Default Policies and Apply the Best Practices to Prepare Workloads for the Falcon Sensor CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which best practice should be followed when preparing a Windows workload for Falcon sensor deployment?

   • AVerify that the workload meets the minimum system requirements and has outbound connectivity to CrowdStrike cloud
   • BDisable Windows Defender to avoid conflicts with the Falcon sensor
   • CEnsure the workload has a static IP address for sensor communication
   • DInstall the sensor before any other security software to avoid conflicts
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a recommended best practice for handling sensor updates in a large environment?

   • AUse a staged rollout to a small group first, then expand to the rest of the environment
   • BOnly update sensors on critical servers and leave others on older versions
   • CDisable automatic updates and manually update each sensor individually
   • DApply updates to all sensors simultaneously to keep versions consistent
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the impact of the default sensor update policy on the security posture of a workload?

   • AIt has no effect on the sensor's security capabilities
   • BIt ensures the sensor is always running the latest version, providing the most current protection
   • CIt disables automatic updates, requiring manual intervention to keep sensors current
   • DIt may leave some sensors on older versions temporarily, but this is balanced by the reduced risk of a faulty update
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does the default prevention policy affect the operation of a newly installed Falcon sensor?

   • AIt blocks all potentially malicious activity immediately, which may require tuning to avoid false positives
   • BIt provides a baseline level of prevention that can be adjusted by administrators to suit their environment
   • CIt prevents the sensor from sending telemetry to the cloud until the policy is reviewed
   • DIt only monitors activity and does not take any preventive actions until a custom policy is assigned
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying the Falcon sensor to a fleet of Windows servers that are domain-joined. The security team wants to ensure that the sensor can be installed and managed without requiring local administrator credentials on each server. What is the best practice to achieve this?

   • AUse a GPO to deploy the sensor with a domain service account that has local admin rights.
   • BManually install the sensor on each server using the local administrator account.
   • CUse the 'Sensor Update' policy to push the sensor to the servers.
   • DDisable UAC on all servers to simplify the installation.
   Reveal Solution Discussion Select an answer first