The CrowdStrike Falcon console provides several methods for determining the sensor version on an endpoint, including the Host Management interface, the Investigate app, and various reports. The command sc query csagent -version is not a valid method. The Windows Service Control (sc) command is used to manage services, and its query function retrieves a service's status (e.g., RUNNING, STOPPED). It does not have a -version parameter to check the software version of the service's executable. While command-line methods do exist on the endpoint to find the sensor version, the specific syntax provided in this option is incorrect.

A. The Falcon console provides reporting capabilities, such as the 'Hosts' view, which can be filtered by endpoint and includes a column for the 'Agent version'.

B. Using the Host Search feature within the Investigate app is a primary method to find an endpoint and view its comprehensive details, which prominently displays the sensor version.

C. The Host Management page is the central area for viewing and managing deployed sensors. The agent version is a standard column in the host list and is also shown in the detailed view for any selected endpoint.

1. CrowdStrike

Inc. (2023). Falcon Platform: Host and Host Group Management. CrowdStrike Documentation Portal. In the "Viewing Hosts" section

the documentation illustrates that the "Agent version" is a default column in the Host Management console (Hosts > Host management)

confirming options B and C as valid methods.

2. CrowdStrike

Inc. (2023). Falcon Sensor for Windows: Command-Line Tools. CrowdStrike Documentation Portal. This document details the cytool.exe utility

which includes the command cytool version to display the installed sensor version from the command line. This confirms a correct command-line method exists

but it is different from the one presented in option D.

3. Microsoft Corporation. (2021). sc query. Microsoft Docs. The official documentation for the sc command lists all valid parameters for the query option. There is no -version or equivalent parameter

confirming that the command in option D is syntactically incorrect and will not function as described.