CrowdStrike Certified Falcon Administrator (CCFA) — Question 146

Which command would tell you if a Falcon Sensor was running on a Windows host?

Answer options

• A. netstat.exe -f
• B. cswindiag.exe -status
• C. sc.exe query falcon
• D. sc.exe query csagent

Correct answer: D

Explanation

The correct answer is D, as 'sc.exe query csagent' specifically checks the status of the CrowdStrike Falcon Sensor service on a Windows host. Options A and B do not provide relevant information about the Falcon Sensor, and option C queries a different service that may not reflect the sensor's status.