3.6 Locate Inactive Sensors CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the CrowdStrike Falcon console, which condition defines a sensor as inactive?

   • AThe sensor has been manually disabled by an administrator in the console.
   • BThe sensor is currently online but has not received a policy update in the last 24 hours.
   • CThe sensor is running an outdated sensor version that is no longer supported.
   • DThe sensor has not checked in with the Falcon Cloud for more than 30 days.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is decommissioning a data center and needs to remove all servers that are being retired from the Falcon console. The administrator has a list of hostnames for the servers. What is the most efficient way to remove these hosts?

   • AUse Host Management to filter by 'Inactive' status and remove all inactive hosts.
   • BUse Host Management to search for each hostname and remove them individually.
   • CCreate a report of all hosts and then manually remove each one from the console.
   • DUse the API to query the hosts by hostname and then remove them in bulk.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a mix of servers and workstations. Some servers are intentionally powered off for maintenance and have been inactive for 10 days. The administrator wants to avoid removing these servers from the console because they will be back online soon. However, the administrator also wants to reduce the number of inactive sensors shown in the default host list. What is the best approach?

   • ACreate a custom dashboard that excludes inactive sensors.
   • BUse the Host Management filter to view only active sensors, and leave the inactive servers in the console.
   • CChange the sensor's policy to a maintenance mode that prevents it from showing as inactive.
   • DRemove the inactive servers from the console and re-add them when they come back online.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has a policy that any sensor inactive for more than 60 days must be removed from the Falcon console. The administrator needs to identify all such sensors and remove them in bulk. What is the most efficient approach?

   • ACreate a report of all hosts and then use the report to manually remove each host.
   • BUse the dashboard's 'Inactive Sensors' widget to see the count and then remove them one by one.
   • CUse Host Management to filter by 'Inactive' status, sort by last-seen date, and select the hosts that meet the 60-day threshold for removal.
   • DUse the API to query all hosts and then manually remove each one from the console.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon administrator notices that a sensor is 'Inactive' but the host is still powered on and has network connectivity. The administrator suspects the sensor service may have stopped. What should the administrator do to confirm this and potentially remediate the issue?

   • AChange the sensor's policy to a different one to force a reconnection.
   • BRemove the host from the console and re-add it.
   • CCheck the host's local services to see if the Falcon sensor service is running, and if not, start it.
   • DWait for the sensor to automatically reconnect.
   Reveal Solution Discussion Select an answer first