3.6 Locate Inactive Sensors CCFA Practice Questions (Page 4)

Questions 16–19

1. 16expert · hard

   A Falcon administrator is reviewing the host list and sees a sensor with a status of 'Inactive'. The host is a virtual machine that was cloned from a template. The administrator suspects that the cloned VM has the same sensor ID as the original, causing a conflict. What is the best way to resolve this issue?

   • ARemove the cloned VM from the console and reinstall the sensor with a new sensor ID.
   • BIgnore the inactive status because the original VM is still active.
   • CUse the Falcon console's 'Merge' feature to combine the two hosts.
   • DChange the sensor's policy on the cloned VM to force a new sensor ID.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard · select all that apply

   A Falcon administrator is cleaning up the host list and has identified several sensors that are inactive. The administrator wants to take action on these sensors. Which of the following actions are valid for inactive sensors? (Select all that apply.)

   • AReinstall the sensor on the host.
   • BRemove the host from the Falcon console.
   • CChange the sensor's policy to a different one.
   • DUse the 'Uninstall' action from the console to remove the sensor from the host.
   Check answers Discussion Select an answer first
4. 18foundation · easy

   In the Falcon console, where would an administrator go to view a list of sensors that are currently inactive?

   • AHosts > Host Management, then apply a filter for 'Inactive' status.
   • BInvestigate > Hosts, then use the 'Inactive' search query.
   • CDetection > Activity, then filter by 'Sensor Status'.
   • DDashboard > Sensor Health, then select the 'Inactive' tab.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Falcon administrator is looking at the Host Management page and sees two hosts: Host A has a status of 'Disconnected' and Host B has a status of 'Inactive'. Both hosts have not communicated for 24 hours. What is the most accurate interpretation of these statuses?

   • AHost A has been removed from the console, while Host B is still present.
   • BHost A may be temporarily offline, while Host B has not communicated for a longer period that exceeds the inactivity threshold.
   • CHost A is permanently offline, while Host B is temporarily offline.
   • DBoth hosts have the same issue and will require reinstallation.
   Reveal Solution Discussion Select an answer first