Which option best describes the general process Whereinstallation of the Falcon Sensor on MacOS?

The standard installation process for the CrowdStrike Falcon Sensor on modern macOS versions requires several distinct steps performed in a specific order. First, the installer package (.pkg) is run to place the application files on the system. Second, the sensor must be licensed with the Customer ID (CID) using the falconctl command-line utility. Finally, due to macOS's security framework (TCC), the user must manually approve the Falcon system extension and grant the sensor Full Disk Access in System Settings to ensure it can monitor system activity correctly.

A. Full Disk Access is granted to the installed sensor component (com.crowdstrike.falcon.Agent), not the installer package, and this action is performed after the installation is complete.

B. This method is incomplete. It omits the mandatory, user-interactive steps of approving the system extension and granting Full Disk Access, which are essential for sensor functionality on macOS.

D. The falconctl stats command is used to view the sensor's operational status, not to load or install it. Also, Full Disk Access is granted after installation, not before.

1. CrowdStrike, Inc., "Falcon Sensor for Mac Deployment Guide," Document Version 6.23. (Internal CrowdStrike University Courseware CCFA-200b, Module: Falcon Sensor Deployment). The guide outlines the installation procedure as:

Section: Installing the Falcon Sensor for Mac: Details running the .pkg installer.

Section: Licensing the Sensor: Specifies using the command sudo /Applications/Falcon.app/Contents/Resources/falconctl license .

Section: System Approvals for macOS Big Sur 11 and later: Explicitly details the post-installation steps of approving the system extension and granting Full Disk Access via System Settings/Preferences. This confirms the sequence described in option C.