2.3 Uninstall a Sensor CCFA Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   A macOS laptop is being returned to a contractor who will no longer work with the company. The admin must remove the Falcon sensor and confirm no files remain. The admin has the maintenance token. Which steps should be taken?

   • ARun the uninstall script from /Library/CS/falconctl with the maintenance token, then verify the /Library/Application Support/CrowdStrike folder is gone.
   • BRun sudo pkill -f falcon-sensor and then delete /Library/LaunchDaemons/com.crowdstrike.falcond.plist.
   • CUse the CrowdStrike Falcon console to remove the host from the sensor inventory, which automatically uninstalls the sensor.
   • DDrag the CrowdStrike app from the Applications folder to the Trash, then empty the Trash.
   Reveal Solution Discussion Select an answer first