I85PREP
⌘ K
CrowdStrike CCSA study materials
CrowdStrike CCSA study resources

CrowdStrike CCSA practice questions

One question at a time. Build your CrowdStrike CCSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Platform and Architecture Fundamentals

In the CrowdStrike Falcon platform, what is the primary function of the sensor agent installed on an endpoint?

  1. It collects and streams telemetry to the cloud for detection and response Correct answer.
  2. It replaces the host firewall with a cloud-managed ruleset
  3. It performs full-disk encryption key escrow
  4. It acts as a local proxy for all outbound web traffic

Explanation

The lightweight Falcon sensor is a cloud-connected agent whose job is to capture endpoint activity and send telemetry to the Falcon platform, where detection logic runs. It is not a firewall replacement, encryption escrow service, or general web proxy, so those roles fall outside its design.

Question 2Cloud Platform and Architecture Fundamentals

Which statement best describes the Falcon platform's cloud-native delivery model?

  1. A peer-to-peer mesh with no central detection service
  2. A multi-tenant SaaS backend with lightweight agents and browser consoles Correct answer.
  3. Single-tenant appliances deployed inside each customer data center
  4. An on-premises virtual machine that customers patch and scale themselves

Explanation

Falcon is delivered as a multi-tenant cloud service: agents and consoles connect to shared, CrowdStrike-operated infrastructure that handles detection, storage, and updates. Customers do not host or patch the detection backend themselves.

Question 3Cloud Platform and Architecture Fundamentals

What does the term 'single lightweight agent' mean in the context of Falcon architecture?

  1. One agent per endpoint that consolidates multiple protection capabilities Correct answer.
  2. One agent that must be paired with a second management agent
  3. One agent per subnet that scans all hosts on that segment
  4. One agent installed only on domain controllers

Explanation

Falcon consolidates capabilities such as next-gen antivirus, EDR, and threat intelligence consumption into a single sensor per host. This avoids stacking several separate agents for different protections.

Question 4Cloud Platform and Architecture Fundamentals

Which Falcon component is responsible for applying prevention policy and detection logic on the host itself?

  1. The threat intelligence feed
  2. The sensor running on the endpoint Correct answer.
  3. The cloud detection engine only
  4. The browser-based console

Explanation

The sensor executes on-host prevention and detection logic locally, which lets it act even when connectivity to the cloud is interrupted. The console is a management and visibility interface, and the intelligence feed supplies context rather than enforcement.

Question 5Cloud Platform and Architecture Fundamentals

An administrator wants Falcon to continue blocking known malicious files on a laptop that is offline during a flight. Which architectural property makes this possible?

  1. The cloud queues blocks and applies them after landing
  2. The sensor caches prevention logic and signatures locally on the host Correct answer.
  3. Offline hosts are automatically placed in a reduced-protection group
  4. The console pushes blocks through the airline Wi-Fi

Explanation

Because prevention logic and necessary data reside on the sensor, endpoints retain protection while disconnected and reconcile with the cloud when connectivity returns. Cloud-only enforcement would leave offline devices unprotected.

Question 6Cloud Platform and Architecture Fundamentals

What is the role of the Falcon console in the overall architecture?

  1. It stores raw telemetry permanently on the local browser
  2. It replaces the sensor on servers
  3. It performs all signature matching for every endpoint
  4. It provides the cloud-hosted UI for configuration, investigation, and response Correct answer.

Explanation

The console is the web front end to the platform, used to manage policies, investigate detections, and issue response actions. Detection and enforcement happen in the sensor and cloud backend, not in the browser.

Question 7Cloud Platform and Architecture Fundamentals

Which capability is enabled by the Falcon platform's cloud-side analytics rather than the endpoint sensor alone?

  1. Local file quarantine on the host
  2. Host firewall rule enforcement
  3. Cross-customer threat graph correlation and crowd-sourced detection Correct answer.
  4. Disk defragmentation scheduling

Explanation

The cloud backend aggregates telemetry across the customer base, enabling correlation and crowd-sourced detection that a single host cannot achieve. Host-level actions such as quarantine remain sensor functions.

Question 8Cloud Platform and Architecture Fundamentals

What is a Falcon prevention policy primarily used to control?

  1. How the sensor blocks, detects, or monitors activity on assigned hosts Correct answer.
  2. The licensing tier of the customer tenant
  3. The retention period of cloud telemetry
  4. Which users may log in to the console

Explanation

Prevention policies define the sensor's behavior on targeted hosts, including blocking and detection settings, and are assigned through host groups. Console access is governed by roles, and retention is a separate platform setting.

Question 9Cloud Platform and Architecture Fundamentals

A security team wants a subset of servers to use stricter blocking settings than the rest of the fleet. What is the most appropriate Falcon mechanism?

  1. Create a host group for those servers and assign a tailored prevention policy Correct answer.
  2. Issue a manual block command to each server daily
  3. Change the tenant-wide default and accept the broader impact
  4. Disable the sensor on all other hosts

Explanation

Policies are applied through host groups, so grouping the servers and assigning a stricter policy scopes the change precisely. Manual per-host commands do not scale, and altering the tenant default affects unrelated hosts.

Question 10Cloud Platform and Architecture Fundamentals

Which statement accurately distinguishes Falcon Insight (EDR) from Falcon Prevent (next-gen antivirus)?

  1. Insight provides endpoint detection and response telemetry and investigation, while Prevent focuses on blocking known and unknown malware Correct answer.
  2. Prevent stores telemetry in the cloud, while Insight stores it locally
  3. Insight only works on servers, while Prevent only works on workstations
  4. They are identical products sold under different names

Explanation

Falcon Prevent centers on prevention of malicious execution, whereas Falcon Insight adds EDR capabilities such as rich telemetry, threat hunting, and investigation. They are complementary modules within the same platform.

Question 11Cloud Platform and Architecture Fundamentals

What does Falcon's 'real time response' capability allow an analyst to do?

  1. Change the sensor's cloud region
  2. Rebuild the endpoint operating system remotely
  3. Run commands and inspect the file system on a live host through the cloud Correct answer.
  4. Modify the tenant's billing plan

Explanation

Real time response gives analysts an interactive remote shell and file inspection capability on a live endpoint via the cloud, supporting investigation and containment. It does not reimage hosts or alter commercial settings.

Question 12Cloud Platform and Architecture Fundamentals

An analyst wants to isolate a compromised host from the network while keeping the sensor connected to the cloud. Which Falcon action fits?

  1. Delete the host from the console
  2. Enable network containment for the host Correct answer.
  3. Uninstall the sensor
  4. Disable cloud connectivity for the tenant

Explanation

Network containment restricts a host's network communication while preserving the sensor's link to the cloud so analysts can continue investigating and issue further actions. Removing the sensor or the host record destroys visibility.

Question 13Cloud Platform and Architecture Fundamentals

Why does the Falcon platform emphasize a cloud-delivered threat intelligence feed?

  1. It keeps detection content current without waiting for customer-side signature updates Correct answer.
  2. It eliminates the need for prevention policies
  3. It replaces the need for any endpoint sensor
  4. It stores customer telemetry on the endpoint

Explanation

Cloud delivery lets CrowdStrike update intelligence and detection content continuously, so customers benefit from fresh indicators without managing signature distribution themselves. It supplements, rather than replaces, sensors and policies.

Question 14Cloud Platform and Architecture Fundamentals

Which deployment consideration is most relevant when an organization has endpoints that never connect to the public internet?

  1. The console must be installed on each isolated endpoint
  2. Cloud analytics are automatically disabled for those hosts
  3. A network proxy or similar connectivity path must be provided for the sensor to reach the cloud Correct answer.
  4. They cannot run any Falcon protection and must be excluded

Explanation

The sensor needs a path to CrowdStrike cloud services for policy, telemetry, and updates, so isolated environments typically use an approved proxy or gateway. Local prevention still functions during outages, but sustained cloud communication requires connectivity.

Question 15Cloud Platform and Architecture Fundamentals

What is the purpose of sensor update policies in Falcon?

  1. To set the retention window for telemetry
  2. To control which sensor version is deployed to which host groups Correct answer.
  3. To configure the console's visual theme
  4. To define which users can view detections

Explanation

Sensor update policies let administrators pin or stage sensor versions across host groups, supporting controlled rollouts and version consistency. They do not govern user permissions or data retention.

Question 16Cloud Platform and Architecture Fundamentals

Which statement best explains why Falcon detection logic runs both on the endpoint and in the cloud?

  1. Running twice is required purely for redundancy against disk failure
  2. The cloud handles only licensing checks
  3. On-host logic provides immediate local decisions, while cloud logic adds broader correlation and analytics Correct answer.
  4. The endpoint handles only user authentication

Explanation

Local execution enables fast prevention without round-trip latency, and cloud analytics add cross-environment correlation and updated intelligence. The combination balances speed with depth rather than serving as disk redundancy.

Question 17Cloud Platform and Architecture Fundamentals

A customer asks whether Falcon stores endpoint telemetry on the local disk indefinitely. What is the accurate architectural answer?

  1. Telemetry is deleted immediately and never retained
  2. Yes, all telemetry is retained on the host permanently
  3. Telemetry is primarily sent to and retained in the cloud according to platform settings Correct answer.
  4. Telemetry is stored only in the browser cache

Explanation

The sensor streams telemetry to the cloud, where retention is governed by platform configuration and subscription terms. Local storage is not the primary repository, and telemetry is certainly retained for investigation.

Question 18Cloud Platform and Architecture Fundamentals

Which Falcon feature allows threat hunters to search raw endpoint telemetry across the fleet using a query language?

  1. Event search in the console Correct answer.
  2. Sensor update policy
  3. Host group assignment
  4. Network containment

Explanation

Event search lets analysts query stored telemetry across the environment to hunt for suspicious patterns. Update policies, host groups, and containment are management or response controls rather than search tools.

Question 19Cloud Platform and Architecture Fundamentals

Why is a lightweight sensor design important for large enterprise deployments?

  1. It eliminates the need for operating system patching
  2. It allows the sensor to run without an operating system
  3. It removes the need for any cloud connectivity
  4. It reduces CPU and memory overhead so protection can be deployed broadly without degrading host performance Correct answer.

Explanation

A low-overhead agent can be deployed across large fleets without materially affecting endpoint performance, which supports broad coverage. It does not remove connectivity needs or substitute for OS maintenance.

Question 20Cloud Platform and Architecture Fundamentals

Which statement about the relationship between host groups and policies is correct?

  1. A host can belong to multiple groups, and policy precedence rules determine the effective settings Correct answer.
  2. Host groups cannot be used with prevention policies
  3. A host can belong to only one group ever
  4. Policies are applied directly to individual hosts and groups are decorative

Explanation

Hosts may be members of more than one group, and Falcon resolves which policy applies through precedence rules. Groups are the primary mechanism for scoping prevention, update, and other policies.

Question 21Cloud Platform and Architecture Fundamentals

What does the Falcon platform mean by 'crowd-sourced' detection?

  1. Customers manually write signatures for each other
  2. Endpoints share files directly with one another
  3. Analysts vote on which alerts to close
  4. Telemetry from the broader community informs detection of threats observed elsewhere Correct answer.

Explanation

Cloud aggregation lets the platform learn from activity observed across its customer base, so a threat seen in one environment can inform detection in others. Customers do not author signatures for peers, and endpoints do not exchange files directly.

Question 22Cloud Platform and Architecture Fundamentals

Which of the following is a legitimate reason to use the Falcon console's role-based access control?

  1. To encrypt endpoint disks
  2. To limit which analysts can perform response actions such as containment Correct answer.
  3. To speed up sensor installation on hosts
  4. To reduce cloud storage costs

Explanation

Role-based access control restricts console capabilities by user role, which is essential for governing sensitive actions like containment and RTR. It does not affect sensor installation speed, storage cost, or disk encryption.

Question 23Cloud Platform and Architecture Fundamentals

What is the primary purpose of the Falcon sensor's cloud connectivity check during troubleshooting?

  1. To benchmark the host's disk speed
  2. To verify the host can reach required CrowdStrike cloud endpoints Correct answer.
  3. To validate the user's console password
  4. To confirm the host's MAC address

Explanation

Connectivity checks confirm that the sensor can reach the required cloud service endpoints, which is fundamental to policy delivery and telemetry flow. Disk benchmarking, password validation, and MAC confirmation are unrelated.

Question 24Cloud Platform and Architecture Fundamentals

A regulated customer requires that detection data remain within a specific geography. Which architectural topic should be discussed with them?

  1. The number of analysts on staff
  2. The endpoint's screen resolution
  3. The color scheme of the console
  4. Falcon cloud region selection and data residency options Correct answer.

Explanation

Data residency concerns are addressed through cloud region selection and the platform's data-handling options. Console appearance, staffing, and endpoint display settings have no bearing on where telemetry is stored.

Question 25Cloud Platform and Architecture Fundamentals

Which best describes how Falcon handles a detection once the sensor identifies suspicious behavior?

  1. It immediately powers off the host in all cases
  2. It forwards the file to every other endpoint
  3. It records the event, applies configured prevention, and sends telemetry to the cloud for further analysis and alerting Correct answer.
  4. It waits for a nightly batch job before taking any action

Explanation

The sensor takes locally configured action, records the event, and streams telemetry to the cloud, where analytics and alerting enrich the picture. It does not rely on nightly batches, universally power off hosts, or distribute files to peers.

Question 26Cloud Platform and Architecture Fundamentals

Which component of the Falcon platform is responsible for aggregating telemetry from all sensors and applying detection logic that spans multiple hosts?

  1. The local sensor kernel driver
  2. The cloud-based backend Correct answer.
  3. The endpoint's local event cache
  4. The on-premises management console

Explanation

The Falcon platform's cloud backend ingests telemetry from all sensors and runs cross-host analytics, enabling detections that require a fleet-wide view. Local components handle immediate prevention and buffering, but they do not perform fleet-wide correlation.

Question 27Cloud Platform and Architecture Fundamentals

In the Falcon platform, what is the primary function of a sensor grouping tag such as a host group?

  1. To determine which kernel driver version the sensor installs
  2. To set the maximum retention period for endpoint telemetry in the cloud
  3. To encrypt the communication channel between the sensor and the cloud
  4. To logically organize endpoints so that policies and assignments can be applied consistently Correct answer.

Explanation

Host groups are logical containers used to scope policy assignment and management actions to a defined set of endpoints. They do not control encryption, driver selection, or cloud retention settings.

Question 28Cloud Platform and Architecture Fundamentals

Which Falcon platform capability allows an analyst to run a SQL-like query against raw endpoint telemetry collected across the entire fleet?

  1. Real Time Response
  2. Event search Correct answer.
  3. Prevention policy
  4. Sensor update policy

Explanation

Event search provides a query interface over raw telemetry stored in the cloud, letting analysts hunt across all enrolled hosts. Real Time Response executes commands on live hosts, while policies govern prevention and updates rather than querying telemetry.

Question 29Cloud Platform and Architecture Fundamentals

What is the purpose of the Falcon sensor's cloud connectivity requirement during initial deployment?

  1. The sensor must register with the cloud to receive its configuration and begin reporting telemetry Correct answer.
  2. The sensor must establish a peer-to-peer link with other endpoints on the same subnet
  3. The sensor must obtain a Kerberos ticket from the domain controller to authenticate users
  4. The sensor must download the full threat intelligence database before it can block any execution

Explanation

On first run, the sensor registers with the Falcon cloud, receives its policy configuration, and starts streaming telemetry. Threat intelligence is continuously updated in the cloud rather than downloaded as a one-time full database, and the sensor does not rely on peer-to-peer links or Kerberos for its own operation.

Question 30Cloud Platform and Architecture Fundamentals

Which statement best describes the Falcon platform's approach to storing endpoint telemetry?

  1. Telemetry is written to a shared network file share configured by the administrator
  2. Telemetry is stored only in the sensor's memory and is lost when the host reboots
  3. Telemetry is streamed to the cloud and retained according to platform settings, with limited local buffering Correct answer.
  4. All telemetry is stored indefinitely on the endpoint's local disk for later forensic review

Explanation

Falcon sensors stream telemetry to the cloud, where retention is managed by the platform; local storage is used only for short-term buffering during connectivity loss. Persistent long-term storage on the endpoint or a shared file share is not part of the architecture.

Question 31Cloud Platform and Architecture Fundamentals

Which Falcon component is installed on the endpoint to collect and act on local activity?

  1. The threat intelligence feed
  2. The web-based console
  3. The lightweight sensor Correct answer.
  4. The cloud correlation engine

Explanation

The Falcon sensor is the endpoint-resident component that observes local activity, enforces prevention, and forwards telemetry to the cloud. The correlation engine, console, and intelligence feed are cloud-side services.

Question 32Cloud Platform and Architecture Fundamentals

Which statement accurately describes the relationship between the Falcon console and the cloud backend?

  1. The console is a web front end that reads from and writes to the cloud backend through APIs Correct answer.
  2. The console operates independently of the cloud and caches all data on the administrator's workstation
  3. The console is installed on each endpoint and provides a local user interface
  4. The console runs detection logic locally and only sends alerts to the cloud for storage

Explanation

The Falcon console is a browser-based interface backed by cloud APIs; configuration changes and queries are executed against the cloud backend. Detection logic and data storage reside in the cloud, not in the console or on the administrator's workstation.

Question 33Cloud Platform and Architecture Fundamentals

What is the primary reason the Falcon platform uses a cloud-native architecture rather than relying solely on on-premises appliances?

  1. To ensure that all detection logic executes on the endpoint without any network dependency
  2. To scale analytics and storage elastically across a global fleet without customer-managed infrastructure Correct answer.
  3. To eliminate the need for any local sensor on managed hosts
  4. To guarantee that telemetry never leaves the endpoint's local network

Explanation

A cloud-native design lets the platform scale compute and storage as the fleet grows and avoids requiring customers to deploy and maintain analytics infrastructure. It does not remove the need for a local sensor, nor does it keep all telemetry on the local network.

Question 34Cloud Platform and Architecture Fundamentals

An administrator needs to ensure that endpoints in a high-security lab receive a different prevention policy than the rest of the organization. What is the most appropriate Falcon construct to achieve this?

  1. Assign the lab endpoints to a dedicated host group and attach the required prevention policy to that group Correct answer.
  2. Change the sensor update policy for the entire organization to match the lab requirements
  3. Disable cloud connectivity for the lab endpoints so they use local defaults
  4. Create a new Falcon console user account for each lab endpoint

Explanation

Policies in Falcon are assigned through host groups, so placing the lab endpoints in their own group allows a distinct prevention policy to be applied without affecting other hosts. User accounts, organization-wide update policies, and disabling connectivity do not provide per-group prevention control.

Question 35Cloud Platform and Architecture Fundamentals

A security team wants to prevent users from disabling the Falcon sensor on their workstations. Which platform control should they use?

  1. A sensor protection setting enforced through policy Correct answer.
  2. A real time response script that restarts the sensor
  3. An event search query that alerts on sensor stop events
  4. A host group naming convention that identifies workstations

Explanation

Falcon provides sensor protection settings, configurable through policy, that prevent unauthorized stopping or uninstalling of the sensor. Naming conventions, detection queries, and restart scripts do not prevent users from disabling the sensor.

Question 36Cloud Platform and Architecture Fundamentals

Why does the Falcon platform perform some detection logic in the cloud rather than exclusively on the endpoint?

  1. Cloud-side logic reduces the need for the sensor to collect any telemetry
  2. Cloud-side logic eliminates the need for prevention policies on the endpoint
  3. Cloud-side logic can correlate activity across many hosts and apply intelligence that a single endpoint cannot see Correct answer.
  4. Cloud-side logic allows the endpoint to run without a kernel driver

Explanation

Cloud analytics can correlate events from multiple endpoints and incorporate threat intelligence, enabling detections that require a broader view than any single host possesses. The sensor still collects telemetry, uses a kernel driver, and enforces prevention policies locally.

Question 37Cloud Platform and Architecture Fundamentals

A customer is designing network access for Falcon sensors and wants to minimize the attack surface. Which approach aligns with the platform's architecture?

  1. Allow outbound connections only to the required Falcon cloud endpoints over the specified ports Correct answer.
  2. Permit all outbound traffic so that the sensor can reach any cloud service
  3. Block all outbound traffic and rely on the sensor's local cache for updates
  4. Allow inbound connections from the internet to each sensor for cloud-initiated commands

Explanation

Falcon sensors initiate outbound connections to specific cloud endpoints, so firewall rules should permit only those destinations and ports. Inbound internet access to sensors is not required, and blocking all outbound traffic prevents registration and updates.

Question 38Cloud Platform and Architecture Fundamentals

Which Falcon capability helps an organization meet a requirement that endpoint telemetry be retained in a specific region?

  1. Configuring the sensor to write telemetry to a local database
  2. Selecting a cloud region for the Falcon tenant during deployment Correct answer.
  3. Enabling peer-to-peer telemetry sharing between endpoints
  4. Disabling cloud analytics and relying only on local prevention

Explanation

Falcon tenants are hosted in specific cloud regions, and choosing the appropriate region addresses data residency requirements for telemetry. Local databases, peer-to-peer sharing, and disabling cloud analytics do not provide a regional cloud retention model.

Question 39Cloud Platform and Architecture Fundamentals

An analyst wants to understand why a detection was generated. Which Falcon artifact provides the contextual detail needed for that review?

  1. The console user login audit trail
  2. The sensor update policy revision history
  3. The detection summary with its associated event and process details Correct answer.
  4. The host group assignment log

Explanation

Detection summaries include the event and process context that explains what triggered the detection, supporting investigation. Policy history, group assignment logs, and login audits document administrative changes rather than detection rationale.

Question 40Cloud Platform and Architecture Fundamentals

Which statement best explains why the Falcon sensor is described as lightweight?

  1. It performs focused local prevention and telemetry collection while offloading heavy analytics to the cloud Correct answer.
  2. It installs only during business hours to reduce its footprint
  3. It stores all raw telemetry on disk to avoid using network bandwidth
  4. It requires a dedicated management server on each subnet

Explanation

The sensor is designed to minimize host resource consumption by handling immediate prevention and collection locally while relying on the cloud for heavy analytics and storage. It does not schedule its own installation, store all telemetry on disk, or require per-subnet management servers.

Question 41Cloud Platform and Architecture Fundamentals

A security architect is mapping Falcon data flows for a compliance review. Which flow correctly describes how telemetry reaches the cloud?

  1. The sensor sends telemetry over outbound TLS connections to the Falcon cloud Correct answer.
  2. The cloud connects to endpoints through a reverse proxy installed by the customer
  3. Endpoints upload telemetry to a shared file share that the cloud reads
  4. The console polls each endpoint over inbound SMB connections to collect logs

Explanation

Sensors establish outbound, encrypted connections to the Falcon cloud and stream telemetry there. The console does not poll endpoints, and the architecture does not depend on shared file shares or customer-installed reverse proxies.

Question 42Cloud Platform and Architecture Fundamentals

Which Falcon platform feature allows an organization to extend detection and response coverage to workloads running in containers?

  1. Container-aware sensor deployment and workload protection policies Correct answer.
  2. Prevention policies that apply only to physical servers
  3. Event search queries limited to Windows event logs
  4. Host group naming that includes the word container

Explanation

Falcon supports containerized workloads through sensor deployment options and policies designed for container visibility and protection. Naming conventions, Windows-only queries, and physical-server-only policies do not provide container coverage.

Question 43Cloud Platform and Architecture Fundamentals

Why does the Falcon platform use a streaming model for telemetry rather than relying on scheduled batch uploads?

  1. Streaming reduces the need for local prevention on the endpoint
  2. Streaming eliminates the need for a cloud backend
  3. Streaming supports near-real-time detection and response while batch delays would widen the attacker's window Correct answer.
  4. Batch uploads are incompatible with any encryption protocol

Explanation

Continuous streaming lets the cloud analyze events as they occur, enabling timely detections and response actions. It does not remove the need for local prevention, is not required by encryption, and does not eliminate the cloud backend.

Question 44Cloud Platform and Architecture Fundamentals

An organization wants to ensure that only authorized administrators can change prevention policies. Which Falcon mechanism should they configure?

  1. An event search saved query for policy changes
  2. Role-based access control assignments in the console Correct answer.
  3. A sensor update policy that targets administrator hosts
  4. A host group tag applied to administrator workstations

Explanation

Role-based access control restricts which users can view or modify configuration such as prevention policies. Host group tags, update policies, and saved searches do not govern administrative permissions.

Question 45Cloud Platform and Architecture Fundamentals

A Falcon administrator is troubleshooting why a newly installed sensor is not appearing in the console. Which architectural check is most relevant first?

  1. Verify that the endpoint can reach the required Falcon cloud endpoints over outbound connections Correct answer.
  2. Ensure that the endpoint has a static IP address assigned
  3. Check whether the console user has permission to view all host groups
  4. Confirm that the endpoint's local disk has enough space for indefinite telemetry storage

Explanation

A sensor must register with the Falcon cloud, which requires outbound connectivity to the specified endpoints. Local disk capacity for indefinite storage, console permissions, and static IP addressing are not prerequisites for initial registration.

Question 46Cloud Platform and Architecture Fundamentals

Which statement best describes how the Falcon platform handles a detection that requires both local and cloud data?

  1. The cloud ignores sensor-provided context and relies only on its own intelligence
  2. The sensor and cloud each contribute evidence, and the platform correlates it into a single detection record Correct answer.
  3. The console generates the detection by combining logs pulled from endpoints
  4. The sensor discards local evidence once it forwards raw events to the cloud

Explanation

Falcon detections can draw on local sensor observations and cloud-side analytics, which the platform correlates into a unified detection record. The sensor does not discard evidence, the cloud uses sensor context, and the console does not generate detections.

Question 47Cloud Platform and Architecture Fundamentals

A customer with endpoints in an isolated network segment wants Falcon protection without direct internet access. Which architectural approach is most appropriate?

  1. Configure endpoints to send telemetry directly to each other
  2. Disable the sensor and rely on periodic offline scans
  3. Install the console on the isolated segment and run detection locally
  4. Deploy a designated proxy or gateway that forwards sensor traffic to the Falcon cloud Correct answer.

Explanation

Falcon supports sensor connectivity through an approved proxy or gateway, allowing isolated segments to reach the cloud without direct internet access. The console does not run detection locally, disabling the sensor removes protection, and endpoint-to-endpoint telemetry is not part of the architecture.

Question 48Cloud Platform and Architecture Fundamentals

Which design characteristic of the Falcon platform most directly supports rapid onboarding of tens of thousands of endpoints without capacity planning for analytics infrastructure?

  1. Elastic cloud services that scale with the number of reporting sensors Correct answer.
  2. A fixed per-endpoint allocation of local disk for telemetry storage
  3. A requirement to deploy additional on-premises aggregation servers per region
  4. Manual sharding of the console database by the administrator

Explanation

Because analytics and storage run on elastic cloud services, the platform scales as sensors are added without the customer provisioning aggregation hardware. On-premises servers, fixed local allocations, and manual database sharding are not part of the Falcon model.

Question 49Cloud Platform and Architecture Fundamentals

An analyst observes that a detection includes both a local prevention event and a cloud-generated alert for the same activity. What does this most likely indicate about the platform's architecture?

  1. The cloud alert is a duplicate that should be suppressed by disabling cloud analytics
  2. The local prevention event is invalid because cloud alerts supersede local records
  3. The sensor and cloud are misconfigured and should never produce records for the same activity
  4. Local prevention and cloud analytics operate in parallel and can produce complementary records for one incident Correct answer.

Explanation

Falcon runs prevention on the endpoint and analytics in the cloud, so the same activity can generate both a local prevention event and a cloud-side detection. This is expected behavior, not a misconfiguration, and disabling cloud analytics would reduce visibility.

Question 50Cloud Platform and Architecture Fundamentals

A regulated customer requires that administrative actions in the Falcon console be attributable to individual users. Which architectural control directly supports this requirement?

  1. A host group named after the security team
  2. Individual user accounts with role-based permissions and audited console activity Correct answer.
  3. A shared administrator account with a strong password
  4. A sensor update policy pinned to a specific version

Explanation

Individual accounts with role-based permissions and console auditing make administrative actions attributable to specific users. Shared accounts obscure attribution, while host group names and update policies do not record who performed an action.