2.4 Troubleshoot a Sensor CCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A sensor on a Windows endpoint fails to start after a recent OS update. The administrator suspects the sensor's driver is incompatible with the new OS build. Which log file should the administrator review first to confirm this suspicion?

   • AThe Falcon console's audit log for the host.
   • BThe Windows System event log for driver errors.
   • CThe CrowdStrike sensor installation log.
   • DThe CrowdStrike sensor's own log file in the installation directory.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common cause of a Falcon sensor failing to update to a newer version?

   • AThe sensor is running on a virtual machine.
   • BThe sensor is using a static IP address.
   • CThe sensor's protection is disabled.
   • DThe sensor is not connected to the internet.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A Falcon administrator is troubleshooting a sensor that is not reporting to the cloud. According to the general troubleshooting workflow, which step should be performed FIRST?

   • AEscalate the issue to CrowdStrike support immediately.
   • BIdentify the specific symptom and gather relevant information about the sensor environment.
   • CReboot the endpoint to clear any temporary sensor state.
   • DReinstall the sensor with the latest version to rule out corruption.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a sensor deployment, an administrator installs the Falcon sensor on a Windows server. The installation completes, but the sensor does not appear in the Falcon console's Hosts list after 30 minutes. The administrator verifies the sensor service is running. Which diagnostic step should the administrator take next?

   • AReview the sensor installation log for registration errors or a missing CID.
   • BCheck if the server's clock is synchronized with the correct time zone.
   • CRestart the sensor service and wait another 30 minutes.
   • DEscalate to CrowdStrike support immediately with the sensor version.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Falcon administrator is investigating a host that shows 'Last Seen' as 3 hours ago in the console, but the user reports the machine has been online and working all day. The sensor service is running. Which command should the administrator run on the host to determine if the sensor can currently reach the CrowdStrike cloud?

   • ARun the sensor CLI command to check the sensor's connection status.
   • BReview the sensor's local log file for the last successful heartbeat.
   • CVerify the host's firewall rules for outbound port 443.
   • DCheck the Windows Event Viewer for sensor-related errors.
   Reveal Solution Discussion Select an answer first