CrowdStrike Exam CCFA-200 Topic 7 Question 36 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam

Question #: 36
Topic #: 7

How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

AUnder Dashboards and reports, choose the Sensor Report. Set the 'Last Seen' dropdown to 30 days and reference the Inactive Sensors widget

BUnder Host setup and management, choose the Host Management page. Set the group filter to 'Inactive Sensors'

CUnder Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days

DUnder Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

Show Suggested Answer

Suggested Answer: D

A sensor that has not contacted the Falcon cloud will be automatically deleted from the hosts list after 90 days. A sensor that has not contacted the Falcon cloud for more than seven days is considered inactive and will be moved from the Host Management page to the Trash page. An inactive sensor will remain in the Trash page for 90 days before being permanently deleted from the Falcon platform. You can restore an inactive sensor from the Trash page if it contacts the Falcon cloud again within 90 days.

by Tammara at Jul 01, 2024, 03:32 AM

Limited Time Offer

25%

16 days ago

I think the answer is A. It makes sense to check the Sensor Report for inactive hosts.

upvoted 0 times

...