CCFA-200 practice question 13 of 35

A technician is tasked with uninstalling the CrowdStrike sensor from a decommissioned Linux server. During the process, the technician faces an error indicating insufficient permissions. What is the most appropriate action to resolve this issue and successfully uninstall the sensor?

Full set: 393 questions

Domain Falcon Host/Sensor Management

Answer options
A: Generate a new token from the Falcon Console and rerun the falcon-uninstall command without elevated privileges.
B: Disable the sensor in the CrowdStrike Falcon Console and rerun the falcon-uninstall command.
C: Use sudo to execute the falcon-uninstall command along with the uninstall token. Correct answer
D: Run the falcon-uninstall command as a regular user to remove the sensor.
Correct Answer:
C. Use sudo to execute the falcon-uninstall command along with the uninstall token.
Explanation

Uninstalling the CrowdStrike Falcon sensor on a Linux system requires modifying system-level files and removing services, actions that are restricted to the root user. The error "insufficient permissions" directly indicates the command was executed by a non-privileged user. The standard and most appropriate method to gain the necessary permissions for such a task is to use the sudo (superuser do) command. This elevates the user's privileges for that specific command, allowing the uninstallation process to complete successfully. If a maintenance token is enforced by the prevention policy, it must be supplied along with the command.

Why Incorrect

A. Running the command without elevated privileges is the cause of the permission error, not the solution.
B. Disabling the sensor in the Falcon Console is a remote administrative action and does not grant the local user the required OS-level permissions to uninstall software.
D. Running the command as a regular user is the action that resulted in the "insufficient permissions" error.

References

1. CrowdStrike, Inc. (2023). Falcon Sensor for Linux Deployment Guide. CrowdStrike Documentation Portal. In the section "Uninstalling the Falcon sensor for Linux," the guide explicitly states, "To uninstall the Falcon sensor for Linux, you must have root privileges." It then provides example commands that all begin with sudo, such as sudo yum remove falcon-sensor or sudo apt-get purge falcon-sensor. The guide also details the use of the maintenance token with the falconctl utility, which also requires sudo: sudo /opt/CrowdStrike/falconctl -u --maintenance-token=.

2. Gancarz, J. (2004). Linux and the Unix Philosophy. Digital Press. Chapter 3, "Small is Beautiful," discusses the principle of least privilege, where users operate with minimal permissions and elevate them only when necessary using tools like sudo for administrative tasks such as installing or removing software.

3. MIT OpenCourseWare. (2020). The Missing Semester of Your CS Education. Lecture 2: Shell Tools and Scripting. The course materials explain the Linux file system permissions model and the role of the superuser (root) in system administration. It clarifies that modifying system-wide software installations requires privileges that a standard user does not have, necessitating the use of sudo. (See section on "Permissions and Users").

Scroll to Top