2.4 Troubleshoot a Sensor CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following information is MOST important to provide when escalating a sensor issue to CrowdStrike support?

   • AThe name of the endpoint's primary user.
   • BThe sensor's diagnostic logs and the troubleshooting steps already performed.
   • CThe endpoint's IP address and MAC address.
   • DThe sensor's installation date and installer version.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An administrator notices that a group of Linux servers is running an older sensor version that is no longer listed as supported in the Falcon console. The servers are showing as 'Healthy' but the console displays a warning about the sensor version. The administrator needs to bring these sensors up to date. What should the administrator do first?

   • ACheck the sensor update policy to ensure automatic updates are enabled for the affected host group.
   • BDownload the latest sensor package from the Falcon console and deploy it to the affected servers.
   • CReview the sensor logs to confirm the update failures before taking action.
   • DReboot the servers to force the sensor to check for updates.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When should a Falcon administrator escalate a sensor issue to CrowdStrike support?

   • AImmediately upon noticing any sensor issue, to save time.
   • BAfter the sensor has been offline for more than 24 hours.
   • COnly if the issue affects multiple endpoints.
   • DAfter all standard troubleshooting steps have been exhausted without resolution.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the Falcon console, which status indicates that a sensor is currently communicating with the cloud?

   • AActive
   • BUninstalled
   • COffline
   • DPending
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's Falcon sensors on a remote office subnet show 'Disconnected' in the console, but the hosts have internet access and can browse HTTPS sites. The network team confirms a forward proxy is required for outbound traffic, and the proxy has been configured to allow traffic to api.crowdstrike.com. The sensors were installed with the default proxy settings. Which action should the administrator take first to resolve the connectivity issue?

   • ARun the sensor CLI command to set the proxy address and port, then verify connectivity with the sensor's built-in test.
   • BAdd an exception in the proxy to bypass TLS inspection for the CrowdStrike domain.
   • CVerify that the hosts can resolve api.crowdstrike.com via DNS.
   • DReinstall the sensor with the proxy credentials embedded in the installer command.
   Reveal Solution Discussion Select an answer first