CrowdStrike Certified Falcon Administrator (CCFA) — Question 170

To test a new Falcon sensor version, you have created a new sensor update policy and two separate dynamic host groups. One group contains all test Windows servers. The other group contains all of your Windows servers. The new policy was applied to only the test Windows servers host group.

What is required to safely and successfully test your new sensor update policy on only your test Windows servers?

Answer options

• A. The new Falcon sensor version should be manually installed by you on every test Windows server before ever enabling and assigning the new policy
• B. The new policy must be enabled and assigned a precedence that is higher when compared to the policy assigned to all Windows servers
• C. The new policy must be enabled and assigned a precedence that is lower when compared to the policy assigned to all Windows servers
• D. The new Falcon sensor version should be manually uninstalled by you on every test Windows server before ever enabling and assigning the new policy

Correct answer: B

Explanation

The correct answer is B because assigning a higher precedence to the new policy ensures that it takes effect on the test Windows servers, allowing for the new sensor update to be tested without interference from the broader Windows server policy. Option A is incorrect as manual installation is not necessary; option C would prevent the new policy from being applied correctly; and option D is also incorrect since uninstalling the sensor version is not a requirement for testing the policy.