If an inactive sensor is no longer needed, what can an administrator do in the Falcon console?

Mark the sensor as 'Active' manually.

Remove the host from the console.

Ignore the sensor; it will automatically delete itself.

Reassign the sensor to a different prevention policy.

A Falcon administrator is trying to determine why a sensor is inactive. The host is a laptop that is used by a sales representative who travels frequently. The laptop is often turned off for several days at a time. What is the most likely reason for the inactive status?

The sensor is not installed on the laptop.

The laptop is in a different country and cannot connect to the Falcon cloud.

The sensor has been uninstalled by the user.

The laptop is powered off for extended periods, so the sensor cannot communicate.

A Falcon administrator is trying to identify which sensors are inactive in a large environment. The administrator wants to see only the hosts that have not communicated for more than 7 days. What is the best way to achieve this in the Falcon console?

Use the API to query all hosts and then manually review the last-seen timestamps.

Use the dashboard's 'Sensor Status' widget and click on the 'Inactive' segment to see the list.

Create a report of all hosts with a status of 'Inactive' and then export it to a CSV file.

Use the Host Management page, filter by 'Inactive' status, and then sort by the 'Last Seen' column to identify those older than 7 days.

An administrator wants to see a list of all sensors that have not communicated for more than 14 days. The administrator also wants to be able to select multiple hosts and remove them in one action. What is the most efficient way to do this in the Falcon console?

Create a report of inactive hosts and then manually remove each one from the console.

Use Host Management, filter by 'Inactive' status, sort by last-seen, and use the bulk selection to remove the hosts.

Use the API to query the hosts and then remove them one by one.

Use the dashboard's 'Inactive Sensors' widget to see the list and then remove them individually.

What does the 'Inactive' status indicate about a sensor in the Falcon console?

The sensor has not communicated with the Falcon Cloud for a prolonged period.

The sensor has been uninstalled from the host.

The sensor is running but has not received a policy update.

The sensor is currently online but has a temporary network issue.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 3Objective 6

3.6 Locate Inactive Sensors CCFA Practice Questions (Page 2)

Part of the Host Management and Setup domain, which makes up ~25% of our current practice bank.

19questions here

4free pages

4concepts

Questions 6–10

6foundation · easy
If an inactive sensor is no longer needed, what can an administrator do in the Falcon console?
Select an answer first
7application · medium
A Falcon administrator is trying to determine why a sensor is inactive. The host is a laptop that is used by a sales representative who travels frequently. The laptop is often turned off for several days at a time. What is the most likely reason for the inactive status?
Select an answer first
8application · medium
A Falcon administrator is trying to identify which sensors are inactive in a large environment. The administrator wants to see only the hosts that have not communicated for more than 7 days. What is the best way to achieve this in the Falcon console?
Select an answer first
9application · medium
An administrator wants to see a list of all sensors that have not communicated for more than 14 days. The administrator also wants to be able to select multiple hosts and remove them in one action. What is the most efficient way to do this in the Falcon console?
Select an answer first
10foundation · easy
What does the 'Inactive' status indicate about a sensor in the Falcon console?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.