2.3 Uninstall a Sensor CCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After uninstalling the Falcon sensor from a Windows host, an admin wants to verify that no residual components remain. Which check is the most reliable way to confirm complete removal?

   • AEnsure that the Windows Event Log no longer contains Falcon-related entries.
   • BCheck that the host no longer appears in the Falcon console's host inventory.
   • CConfirm that the Falcon sensor process is not running in Task Manager.
   • DVerify that the Falcon service is no longer listed in services.msc and that the CrowdStrike directory in Program Files is gone.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An admin is planning to uninstall the Falcon sensor from a fleet of Windows and Linux hosts. The admin wants to ensure the uninstall is authorized and can be verified. What should the admin do first?

   • ACreate a local admin account on each host to run the uninstall.
   • BDisable the Falcon sensor's self-protection feature from the console.
   • CRun a vulnerability scan on each host to ensure no other security software is installed.
   • DObtain the maintenance token from the Falcon console for each host.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A macOS admin is trying to uninstall the Falcon sensor but does not have the maintenance token. The admin has root access on the host. What is the best course of action?

   • AContact CrowdStrike support to request a bypass token.
   • BUse sudo to force-delete the CrowdStrike application files and kernel extension.
   • CBoot the Mac into Recovery Mode and erase the entire disk.
   • DObtain the maintenance token from the Falcon console before attempting the uninstall.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Windows admin needs to uninstall the Falcon sensor from a remote server that has no interactive desktop session. The admin has the maintenance token. Which approach should be used?

   • AOpen the Control Panel on the server via RDP and use the Programs and Features applet.
   • BRun msiexec /x {GUID} /qn MAINTENANCE_TOKEN=<token> via a remote PowerShell session.
   • CUse the Falcon console to send an uninstall command to the sensor.
   • DSchedule a task to run the uninstaller at the next logon.
   Reveal Solution Discussion Select an answer first
6. 15foundation · medium

   Which command is used to uninstall the Falcon sensor on a macOS host?

   • Asudo yum remove falcon-sensor
   • Bsudo rm -rf /Library/CS/falcon-sensor
   • Csudo dpkg --purge falcon-sensor
   • Dsudo /opt/CrowdStrike/falconctl -u
   Reveal Solution Discussion Select an answer first