CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ20

VerifiedSensor Deployment

The Falcon sensor uses certificate pinning to protect against man-in-the-middle attacks. What must be disabled to allow the sensor to communicate with the CrowdStrike Cloud?

Explanation

Certificate pinning requires the TLS certificate presented during the Cloud connection to match the certificate expected by the Falcon sensor. Deep packet inspection can intercept and re-sign TLS traffic, presenting a different certificate and preventing the pinned-certificate validation from succeeding.

Community Discussion

No comments yet. Be the first to start the discussion!