What is the primary purpose of the maintenance token in the Falcon sensor uninstall process?

To unlock the sensor's advanced features

To authenticate the host to the Falcon console during installation

To encrypt the sensor's communication with the Falcon cloud

To prevent unauthorized uninstallation of the sensor

A Windows admin uninstalled the Falcon sensor using the Control Panel. After the uninstall, the admin notices that the CrowdStrike directory still exists in Program Files. What should the admin do?

Ignore the directory because it is harmless.

Reinstall the sensor and then uninstall it again using msiexec.

Manually delete the remaining CrowdStrike directory and verify no Falcon service or driver remains.

Run a disk cleanup tool to remove the directory.

A Linux server running Ubuntu 22.04 is being decommissioned. The admin has the maintenance token and needs to remove the Falcon sensor silently. Which command should be used?

sudo /opt/CrowdStrike/falconctl uninstall --maintenance-token

sudo apt-get purge falcon-sensor

sudo systemctl stop falcon-sensor && sudo rm -rf /opt/CrowdStrike

A Windows admin is uninstalling the Falcon sensor from a server that is part of a domain. The admin has the maintenance token. The uninstall succeeds, but the sensor reappears after the next group policy refresh. What is the most likely cause?

A group policy object is configured to install the Falcon sensor.

The admin did not reboot the server after the uninstall.

The sensor's driver was not removed during the uninstall.

The maintenance token was not used correctly during the uninstall.

A Windows workstation is being decommissioned. The security team wants to remove the Falcon sensor before handing the machine to a third-party recycler. The admin has the maintenance token from the Falcon console. Which command should the admin run from an elevated PowerShell prompt on the host?

msiexec /x {GUID} /qn MAINTENANCE_TOKEN=

sc stop falcon-sensor && sc delete falcon-sensor

del "C:\Program Files\CrowdStrike\falcon-sensor.exe"

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 2Objective 3

2.3 Uninstall a Sensor CCFA Practice Questions (Page 1)

Part of the Sensor Deployment domain, which makes up ~19% of our current practice bank.

26questions here

6free pages

6concepts

Questions 1–5

1foundation · medium
What is the primary purpose of the maintenance token in the Falcon sensor uninstall process?
Select an answer first
2application · medium
A Windows admin uninstalled the Falcon sensor using the Control Panel. After the uninstall, the admin notices that the CrowdStrike directory still exists in Program Files. What should the admin do?
Select an answer first
3application · medium
A Linux server running Ubuntu 22.04 is being decommissioned. The admin has the maintenance token and needs to remove the Falcon sensor silently. Which command should be used?
Select an answer first
4expert · hard
A Windows admin is uninstalling the Falcon sensor from a server that is part of a domain. The admin has the maintenance token. The uninstall succeeds, but the sensor reappears after the next group policy refresh. What is the most likely cause?
Select an answer first
5application · medium
A Windows workstation is being decommissioned. The security team wants to remove the Falcon sensor before handing the machine to a third-party recycler. The admin has the maintenance token from the Falcon console. Which command should the admin run from an elevated PowerShell prompt on the host?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.