A macOS admin is uninstalling the Falcon sensor from a laptop that is enrolled in a mobile device management (MDM) solution. The admin has the maintenance token. After uninstalling, the sensor reappears within an hour. What is the most likely cause?

The admin did not reboot the Mac after the uninstall.

The MDM profile is configured to reinstall the sensor automatically.

The maintenance token was not used correctly during the uninstall.

The sensor's kernel extension was not removed during the uninstall.

Which of the following is a sign that the Falcon sensor was not completely uninstalled?

The host's IP address has changed

The Falcon service is still running in the task manager

The host is not responding to ping

The host's clock is synchronized with a time server

Where can an administrator obtain the maintenance token for a Falcon sensor?

From the sensor's installation log

From the Falcon console under the sensor's host details

By contacting CrowdStrike support

From the host's registry or configuration file

Which of the following is a prerequisite that must be satisfied before attempting to uninstall the Falcon sensor from a host?

The host must be running the latest version of the sensor

The sensor must be in an 'Uninstalled' state in the Falcon console

The host must be disconnected from the network

The maintenance token must be provided if the sensor is configured to require it

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 2Objective 3

2.3 Uninstall a Sensor CCFA Practice Questions (Page 4)

Part of the Sensor Deployment domain, which makes up ~19% of our current practice bank.

26questions here

6free pages

6concepts

Questions 16–20

16expert · hard
A macOS admin is uninstalling the Falcon sensor from a laptop that is enrolled in a mobile device management (MDM) solution. The admin has the maintenance token. After uninstalling, the sensor reappears within an hour. What is the most likely cause?
Select an answer first
17foundation · medium
Which of the following is a sign that the Falcon sensor was not completely uninstalled?
Select an answer first
18application · medium
A Linux admin uninstalled the Falcon sensor from a CentOS 7 server using yum. The admin wants to verify that the sensor is completely removed. Which command should the admin run?
Select an answer first
19foundation · medium
Where can an administrator obtain the maintenance token for a Falcon sensor?
Select an answer first
20foundation · medium
Which of the following is a prerequisite that must be satisfied before attempting to uninstall the Falcon sensor from a host?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.