CCFA-200b practice question 5 of 25

Which option best describes the general process Whereinstallation of the Falcon Sensor on MacOS?

Domain Endpoint Security

Answer options

A: Grant the Falcon Package Full Disk Access, install the Falcon package, use falconctl to license the sensor

B: Install the Falcon package passing it the installation token in the command line

C: Install the Falcon package, use falconctl to license the sensor, approve the system extension, grant the sensor Full Disk Access Correct answer

D: Grant the Falcon Package Full Disk Access, install the Falcon package, load the Falcon Sensor with the command 'falconctl stats'

Correct Answer:

C. Install the Falcon package, use falconctl to license the sensor, approve the system extension, grant the sensor Full Disk Access

Explanation

The standard installation process for the CrowdStrike Falcon Sensor on modern macOS versions requires several distinct steps performed in a specific order. First, the installer package (.pkg) is run to place the application files on the system. Second, the sensor must be licensed with the Customer ID (CID) using the falconctl command-line utility. Finally, due to macOS's security framework (TCC), the user must manually approve the Falcon system extension and grant the sensor Full Disk Access in System Settings to ensure it can monitor system activity correctly.

Why Incorrect

A. Full Disk Access is granted to the installed sensor component (com.crowdstrike.falcon.Agent), not the installer package, and this action is performed after the installation is complete.
B. This method is incomplete. It omits the mandatory, user-interactive steps of approving the system extension and granting Full Disk Access, which are essential for sensor functionality on macOS.
D. The falconctl stats command is used to view the sensor's operational status, not to load or install it. Also, Full Disk Access is granted after installation, not before.

References

1. CrowdStrike, Inc., "Falcon Sensor for Mac Deployment Guide," Document Version 6.23. (Internal CrowdStrike University Courseware CCFA-200b, Module: Falcon Sensor Deployment). The guide outlines the installation procedure as:

Section: Installing the Falcon Sensor for Mac: Details running the .pkg installer.

Section: Licensing the Sensor: Specifies using the command sudo /Applications/Falcon.app/Contents/Resources/falconctl license .

Section: System Approvals for macOS Big Sur 11 and later: Explicitly details the post-installation steps of approving the system extension and granting Full Disk Access via System Settings/Preferences. This confirms the sequence described in option C.

Keep practicing

Take the free CCFA-200b practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test