3.3 Explain the Effect of Disabling Detections on a Host CCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   An administrator disabled detections on a host to troubleshoot a performance issue. After resolving the issue, they want to restore normal visibility. What is the correct process to re-enable detections?

   • AWait for the next sensor update, which will automatically re-enable detections
   • BReinstall the Falcon sensor on the host
   • CSubmit a support ticket to have detections re-enabled
   • DIn the Falcon console, navigate to Host Management, select the host, and re-enable detections
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   An administrator disabled detections on a host for a weekend maintenance task. On Monday, they need to ensure the host is fully visible again. What is the first step they should take?

   • ACheck the host's prevention policy
   • BRun a sensor update on the host
   • CRe-enable detections on the host from the Falcon console
   • DVerify that the host is still connected to the Falcon cloud
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the first step an administrator should take to re-enable detections on a host?

   • AContact CrowdStrike support to unlock the host.
   • BNavigate to the host's settings in the Falcon console and enable detections.
   • CReinstall the Falcon sensor on the host.
   • DRun a command on the host to restart the sensor.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary effect of disabling detections on a host regarding the Falcon console?

   • AThe host no longer appears in the Host Management page.
   • BDetection alerts and associated events for that host are no longer displayed in the console.
   • CAll prevention activity for the host is hidden from the console.
   • DThe host's sensor status is shown as offline in the console.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   An administrator disabled detections on a host and later re-enabled them. What is the immediate effect of re-enabling?

   • AThe host's prevention policy is automatically updated
   • BThe host must be rebooted for the change to take effect
   • CThe sensor generates detection events for all activity that occurred while detections were disabled
   • DThe sensor resumes generating detection events for new activity
   Reveal Solution Discussion Select an answer first