Assume the Falcon Sensor was installed on a Virtual Machine template using the installation parameter NO_START=1. Afterward, the Virtual Machine template is rebooted. What is the effect on the…

Question

Options

• AThe Falcon Sensor would start, but only send a heartbeat to the Falcon console
• BThe Falcon Sensor would not automatically start on reboot. It would have to be manually started
• CThe Falcon Sensor would disable BIOS checks at startup
• DThe Falcon Sensor would start at reboot and generate an Agent ID.

• A
  5% (2)
• B
  78% (29)
• C
  14% (5)
• D
  3% (1)

Explanation

Option B is correct because NO_START=1 is a CrowdStrike installation parameter that prevents the Falcon Sensor service from being configured to start automatically - this behavior persists through reboots. The sensor is installed but remains dormant until an administrator manually starts it (or a provisioning script does so). This parameter exists precisely for VM template use cases, where you don't want each cloned VM to inherit an active sensor that might conflict on Agent ID (AID) registration.

Why the distractors are wrong:

• A is wrong because the sensor doesn't start at all - not even in a limited "heartbeat-only" mode. No partial operation occurs.
• C is completely fabricated; the Falcon Sensor has no interaction with BIOS checks at startup.
• D describes normal installation behavior (sensor starts and generates an AID), but NO_START=1 explicitly overrides that - preventing auto-start and AID generation until the service is manually triggered, which is the whole point when building templates to avoid AID conflicts in clones.

Memory tip: Think of NO_START=1 as a "freeze" flag - it freezes the sensor in a permanently-off state that survives reboots. In VM templates, you want it frozen so each clone can "thaw" and register independently with its own unique AID.

No community discussion yet for this question.