CrowdStrike Exam CCFA-200 Topic 7 Question 36 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam

Question #: 36
Topic #: 7

How can you find a list of hosts that have not communicated with the CrowdStrike Cloud in the last 30 days?

AUnder Dashboards and reports, choose the Sensor Report. Set the 'Last Seen' dropdown to 30 days and reference the Inactive Sensors widget

BUnder Host setup and management, choose the Host Management page. Set the group filter to 'Inactive Sensors'

CUnder Host setup and management > Managed endpoints > Inactive Sensors. Change the time range to 30 days

DUnder Host setup and management, choose the Disabled Sensors Report. Change the time range to 30 days

Show Suggested Answer

Suggested Answer: D

A sensor that has not contacted the Falcon cloud will be automatically deleted from the hosts list after 90 days. A sensor that has not contacted the Falcon cloud for more than seven days is considered inactive and will be moved from the Host Management page to the Trash page. An inactive sensor will remain in the Trash page for 90 days before being permanently deleted from the Falcon platform. You can restore an inactive sensor from the Trash page if it contacts the Falcon cloud again within 90 days.

by Tammara at Jul 01, 2024, 03:32 AM

Limited Time Offer

25%

Off

Get Premium CCFA-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lindsey

1 months ago

Wait, there's a 'Disabled Sensors Report'? What is this, a horror movie? I'll stick with C, thank you very much.

upvoted 0 times

Jeniffer

2 days ago

That's a smart choice, it's under Host setup and management > Managed endpoints > Inactive Sensors.

upvoted 0 times

...

Peggie

5 days ago

I agree, I'll go with option C to find the list of hosts.

upvoted 0 times

...

Rebbeca

10 days ago

I think the 'Disabled Sensors Report' sounds spooky.

upvoted 0 times

...

Gene

1 months ago

Hmm, D seems a bit too specific. I think I'll play it safe and choose C. Can't go wrong with that one.

upvoted 0 times

Darell

4 days ago

User3: I'm going with C, better safe than sorry when it comes to managing endpoints.

upvoted 0 times

...

Nickole

13 days ago

User2: I agree, A sounds like the best option for finding inactive hosts.

upvoted 0 times

...

Samira

1 months ago

User1: I think I'll go with option A, seems like the most straightforward choice.

upvoted 0 times

...

Paz

2 months ago

Haha, who writes these exam questions? They're making it way too easy. I'll go with C, no brainer!

upvoted 0 times

Lai

17 days ago

User 3: Yeah, C seems like the right choice for finding inactive hosts.

upvoted 0 times

...

Catalina

29 days ago

User 2: I'll go with C, no brainer!

upvoted 0 times

...

Nidia

1 months ago

User 1: Haha, who writes these exam questions? They're making it way too easy.

upvoted 0 times

...

Rima

2 months ago

I'm going with B. Filtering the host management page for inactive sensors seems like the easiest approach.

upvoted 0 times

Loreta

25 days ago

User2: Yeah, that sounds like the easiest approach. Let's try that.

upvoted 0 times

...

Alica

1 months ago

User1: I think B is the way to go. Filtering for inactive sensors on the host management page is simple.

upvoted 0 times

...

Malissa

2 months ago

Option C looks like the way to go. Clear and straightforward instructions on where to find the inactive sensors report.

upvoted 0 times

...

Nelida

2 months ago

Hmm, you might be right. Let's review the options again before making a final decision.

upvoted 0 times

...

Cherry

3 months ago

I disagree, I believe the answer is C. Managed endpoints > Inactive Sensors seems more appropriate.

upvoted 0 times

...

Nelida

3 months ago

I think the answer is A. It makes sense to check the Sensor Report for inactive hosts.

upvoted 0 times

...