2.4 Troubleshoot a Sensor CCFA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Falcon administrator is troubleshooting a sensor on a Linux host that is 'Disconnected'. The host has a static IP and can reach the internet. The administrator runs the sensor CLI connectivity test, which fails. The network team confirms that outbound HTTPS is allowed, but they have implemented TLS inspection on the proxy. The proxy certificate is not trusted by the host. What is the most likely cause of the connectivity failure?

   • AThe sensor's version is too old to support the proxy configuration.
   • BThe sensor does not trust the proxy's TLS inspection certificate.
   • CThe sensor's local firewall is blocking outbound traffic.
   • DThe sensor is not configured to use the proxy.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is the primary purpose of collecting sensor logs during troubleshooting?

   • ATo determine the sensor's version and build number.
   • BTo monitor real-time sensor performance metrics.
   • CTo verify that the sensor is compliant with security policies.
   • DTo identify the root cause of a sensor malfunction.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A new administrator is troubleshooting a sensor that is showing as 'Installing' in the console for an extended period. The sensor was installed on a Windows machine, and the service is running. What is the most likely cause of this status, and what should the administrator check first?

   • AThe sensor is waiting for a reboot to complete the installation; check the host's pending reboot status.
   • BThe sensor is unable to reach the cloud; check the network connectivity from the host.
   • CThe sensor's CID is incorrect; check the installation command used.
   • DThe sensor is paused by a policy; check the sensor update policy.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Falcon sensor is not connecting to the cloud. Which network component is MOST likely to be the cause if the sensor can reach the internet but not the CrowdStrike cloud?

   • AAn outbound proxy is blocking or not allowing the sensor's traffic.
   • BThe local DNS server is not resolving the sensor's hostname.
   • CThe sensor's local firewall is blocking inbound connections.
   • DThe endpoint's default gateway is misconfigured.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Falcon administrator is reviewing the console and notices a sensor is showing as 'Not Installed' but the host is online. The administrator has confirmed the sensor service is not running on the host. What should the administrator do first to troubleshoot this issue?

   • AVerify the host's network connectivity to the cloud.
   • BCheck the host's system event log for service errors.
   • CAttempt to start the sensor service on the host.
   • DReinstall the sensor on the host.
   Reveal Solution Discussion Select an answer first