The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. What must you ensure is disabled for the sensor to communicate with the CrowdStrike Cloud?

Question

Options

• AProxy information
• BDeep packet inspection
• CNMAP scanning
• DTCP inspection

• A
  2% (1)
• B
  91% (41)
• C
  4% (2)
• D
  2% (1)

Explanation

Deep packet inspection (DPI) must be disabled because it intercepts and inspects TLS traffic at the payload level - effectively acting as a man-in-the-middle itself. Since the Falcon sensor uses certificate pinning, it validates the exact certificate presented by CrowdStrike's cloud; a DPI device that terminates and re-encrypts TLS will present a different certificate, causing the pinned connection to fail and blocking sensor communication.

Why the distractors are wrong:

• A (Proxy information): Proxies can actually be configured to work with the Falcon sensor; they route traffic but don't inherently break certificate pinning the way TLS inspection does.
• C (NMAP scanning): NMAP is a network discovery/port-scanning tool with no role in TLS session handling - it doesn't interfere with sensor-to-cloud communication.
• D (TCP inspection): TCP-level inspection examines packet headers and flow metadata, not the TLS payload or certificates, so it doesn't break certificate pinning.

Memory tip: Think of certificate pinning as a "VIP badge check" - the sensor only trusts one specific badge (CrowdStrike's pinned cert). DPI is like a bouncer who swaps everyone's badge with their own copy; the sensor sees the wrong badge and refuses entry. Anything that re-signs TLS traffic will break pinning; things that merely observe or route traffic generally won't.

No community discussion yet for this question.