3.6 Locate Inactive Sensors CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is migrating to a new endpoint management tool and wants to remove all inactive sensors from the Falcon console to clean up the host list. The administrator has confirmed that the hosts are no longer in use. What is the recommended way to handle these inactive sensors?

   • AReinstall the Falcon sensor on each host to bring them back to active status.
   • BIgnore the inactive sensors because they will automatically disappear after 90 days.
   • CChange the sensor's policy to 'Uninstall' to automatically remove the sensor from the host.
   • DRemove the hosts from the Falcon console using the 'Remove' option in Host Management.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator is reviewing the host list and sees a sensor that has been 'Inactive' for 45 days. The host is a critical server that is still in production and has network connectivity. What should the administrator do first to remediate this issue?

   • AInvestigate why the sensor is not communicating, such as checking for firewall blocks or sensor service status.
   • BRemove the host from the console and re-add it later.
   • CImmediately reinstall the Falcon sensor on the host.
   • DIgnore the status because the sensor will automatically recover.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which filter option in the Host Management page would an administrator select to display only sensors that are considered inactive?

   • AState: Disconnected
   • BHealth: Unhealthy
   • CStatus: Inactive
   • DPlatform: Windows
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An administrator needs to generate a list of all sensors that have not communicated with the Falcon cloud for more than 30 days. The company has thousands of hosts, and the administrator wants to focus only on those that are currently inactive. What is the most efficient way to accomplish this in the Falcon console?

   • ARun a report from the Falcon console's reporting module for all hosts with a last-seen date older than 30 days.
   • BUse the dashboard's 'Sensor Status' widget and click on the 'Inactive' segment.
   • CSearch the event data for hosts that have not sent heartbeat events in the last 30 days.
   • DUse the Host Management page and apply a filter for 'Inactive' status.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which action can an administrator take in the Falcon console to remediate an inactive sensor?

   • AChange the sensor's prevention policy.
   • BUpdate the sensor's hostname.
   • CReboot the Falcon Cloud.
   • DReinstall the sensor on the host.
   Reveal Solution Discussion Select an answer first