Common interview slip
A lot of candidates say 'CrowdStrike Falcon is just antivirus in the cloud that matches malware signatures'. That answer sinks a Falcon interview straight away.
Falcon is a cloud-native endpoint protection platform built on a single lightweight sensor that streams telemetry to the Threat Graph, where trillions of events are correlated across every protected endpoint. Its NGAV (Falcon Prevent) blocks malware and malware-free attacks using machine learning, exploit mitigation and Indicators of Attack (IOAs) — behaviour and intent, not just signatures — while EDR (Falcon Insight) records everything for detection, visibility and hunting. Because it models attacker behaviour rather than only known-bad artifacts, it catches fileless, novel and zero-day attacks a signature-only AV misses. Knowing that distinction — and IOA vs IOC — is exactly what interviewers test.
① The Falcon platform — one lightweight cloud-native sensor and the Threat Graph
Q: What is the CrowdStrike Falcon platform, and why is the single agent a big deal?
Model answer: Falcon is a cloud-native endpoint protection platform delivered as SaaS. Every endpoint runs one lightweight sensor (a single agent) that streams security telemetry up to the CrowdStrike Security Cloud. There are no on-prem management servers, no daily signature downloads and no reboots to update. The single-agent design matters because you deploy and maintain just one sensor, yet you can switch on many modules — EDR, NGAV, vulnerability management, identity, cloud — from the cloud without ever installing another agent.
Q: What is the Threat Graph?
Model answer: The Threat Graph is the brain in the cloud. It ingests and correlates trillions of events from every protected endpoint and links processes, files, network connections and users into one graph. That cross-customer, cloud-scale correlation is how Falcon spots a faint attack pattern on one machine by recognising it from millions of others — something a standalone on-box AV can never do.
Q: How is this different from legacy antivirus?
Model answer: Legacy AV is a heavy on-box agent that matches signatures of known malware, needs constant definition updates and an on-prem server, and is blind to anything new or fileless. Falcon flips that: a thin cloud-managed sensor, detection driven by machine learning and Indicators of Attack, intelligence from the Threat Graph, and EDR recording for hunting. The one-liner: legacy AV matches known-bad signatures on the box; Falcon analyses behaviour in the cloud and records everything.
When asked what CrowdStrike Falcon is, anchor your answer with 'a cloud-native platform built on a single lightweight sensor that streams telemetry to the Threat Graph, with NGAV and EDR driven by Indicators of Attack, not just signatures'. That one line proves you understand the architecture, not just the brand.
What makes the Falcon sensor different from legacy antivirus?
② NGAV vs EDR — Falcon Prevent, Falcon Insight and IOA vs IOC
Q: What is the difference between Falcon Prevent and Falcon Insight?
Model answer: Falcon Prevent is the NGAV (next-gen antivirus) — the prevention layer. It blocks both malware and malware-free attacks at runtime using machine learning, exploit mitigation and Indicators of Attack. Falcon Insight is the EDR — the detection, visibility and response layer. It continuously records endpoint telemetry so you get the full process tree, detections, retrospective hunting and the context to respond. Prevent stops what it can in real time; Insight gives you eyes and history on everything, including what slipped past. They run on the same single sensor.
Q: Explain IOA vs IOC — interviewers love this one.
Model answer: An IOC (Indicator of Compromise) is a known-bad artifact — a hash, IP or domain. It is reactive: useful only once that exact artifact is known. An IOA (Indicator of Attack) is the attacker's behaviour and intent — for example Office spawning PowerShell that injects into memory and reaches out for credentials — regardless of the tool or file. CrowdStrike pioneered the IOA approach. The line to say: IOCs match known-bad artifacts after the fact; IOAs catch the attack behaviour, so they stop novel, zero-day and fileless attacks.
Q: Why does the IOA approach catch fileless / malware-free attacks?
Model answer: Because a fileless attack leaves no malicious file to hash — it lives in memory, abuses legitimate tools (PowerShell, WMI, living-off-the-land) and steals credentials. A signature or hash blocklist has nothing to match. An IOA watches the behaviour chain — the unusual parent-child process, the in-memory execution, the credential access — and flags the intent even though no file ever touched disk. That is why CrowdStrike reports that a large share of modern intrusions are malware-free, and why behaviour-based detection is essential.
One lightweight cloud-native sensor per endpoint streams telemetry to the CrowdStrike cloud, where the Threat Graph correlates trillions of events across all endpoints — no on-prem servers, no reboots, no daily signatures.
An IOC is a known-bad artifact (hash, IP, domain) and is reactive. An IOA is the attacker's behaviour and intent regardless of the tool — so it catches novel, zero-day and fileless attacks.
Falcon Prevent is the NGAV (prevention) — blocks malware and malware-free attacks with ML, exploit mitigation and IOAs. Falcon Insight is the EDR (detection, visibility, hunting). Same single sensor.
OverWatch is human-led 24/7 managed threat hunting that surfaces threats to your team. Falcon Complete is fully managed MDR — CrowdStrike monitors, responds and remediates for you.
Two classic errors: calling Falcon 'just cloud antivirus' (it adds behaviour-based IOAs, EDR recording and the Threat Graph), and treating NGAV and EDR as the same thing. Prevent (NGAV) is prevention that blocks at runtime; Insight (EDR) is detection, visibility and response that records everything. Blurring them is a red flag in a Falcon interview.
A phishing macro launches PowerShell that runs entirely in memory with no file on disk. Which Falcon approach catches it?
③ One agent, many modules — OverWatch, Spotlight, Identity, Cloud and XDR
Q: How can one Falcon sensor deliver EDR, vulnerability management, identity and cloud security?
Model answer: Because the platform is single-agent and cloud-licensed. The one sensor already collects rich telemetry; turning on a module is a cloud entitlement, not a new agent or a reboot. So the same sensor powers Insight (EDR), Prevent (NGAV), Discover (asset and IT hygiene), Spotlight (scanless vulnerability management), Identity Threat Protection, Falcon Cloud Security (workload protection, CSPM, CNAPP), Falcon LogScale (Next-Gen SIEM, formerly Humio) and Falcon Fusion (SOAR/workflow automation), with Charlotte AI as the GenAI analyst on top.
Q: What is Falcon OverWatch?
Model answer: OverWatch is CrowdStrike's human-led, 24/7 managed threat hunting team. They proactively hunt for the stealthy, hands-on-keyboard intrusions that automation alone might miss — an attacker quietly living off the land. When they find something, they raise a high-fidelity, enriched detection to your team. It is expertise as a service layered on the same telemetry, not a separate product to deploy.
Q: How does this become XDR?
Model answer: XDR (Extended Detection and Response) means correlating telemetry beyond the endpoint — identity, cloud, network, email and third-party tools — into cross-domain detections. Falcon does this by feeding all that telemetry into the Threat Graph and Falcon Next-Gen SIEM / LogScale, so a single incident can stitch an endpoint IOA to an identity anomaly and a cloud event. The interview framing: EDR sees the endpoint; XDR connects the endpoint to identity, cloud and network for one correlated picture.
▶ Watch Falcon catch a fileless attack — and find why nothing was blocked
Step through how a malware-free intrusion becomes an IOA detection and a surgical response. Press Play for the healthy path, then Break it to see the classic policy mistake.
Your SOC wants 24/7 human hunting for stealthy hands-on-keyboard intrusions that automation might miss. Which Falcon capability fits?
④ Operations & incident response — RTR, containment, OverWatch vs Complete, tuning
Q: What is Real Time Response (RTR), and how do you contain a host?
Model answer: Real Time Response gives an analyst a secure remote shell into an endpoint to investigate and remediate live — kill a process, pull or delete a file, inspect the registry, run scripts. For containment, Network Containment isolates the host from the network while keeping its link to the Falcon cloud, so the threat cannot spread laterally but you can still investigate and run RTR — then release it once it is clean. Far more surgical than yanking the cable or powering off.
Q: OverWatch vs Falcon Complete — what is the difference?
Model answer: OverWatch is managed threat hunting — it finds and surfaces threats, then hands them to your team. Falcon Complete is fully managed detection and response (MDR) — CrowdStrike's team runs your endpoint security end to end: they monitor, investigate, respond and remediate on your behalf, often backed by a breach-prevention warranty. Short version: OverWatch hunts and alerts you; Falcon Complete runs and responds for you.
Q: A prevention policy blocked a legitimate app. How do you handle it, and how do you keep sensors safe to update?
Model answer: Don't disable detection. Investigate why it fired, then tune the prevention policy — adjust the policy for that host group or add a targeted exclusion — so you keep protection everywhere else. For updates, use sensor update policies to stagger rollouts (an N-1 / ring-based approach: canary group first, then broaden) rather than pushing the very latest to every machine at once. That, plus mapping detections to MITRE ATT&CK for context, is the operationally mature answer interviewers want — tune and stage, never blanket-disable.
Neha, a SOC analyst at a Bengaluru SaaS company, faces this
Falcon Insight raises a high-severity detection on a finance laptop: Outlook spawned PowerShell, which executed in memory and reached out to an unfamiliar host. No malicious file was written to disk. Neha must triage it and explain her steps in the interview-style debrief.
A phishing email with a macro launched a malware-free, living-off-the-land attack — PowerShell running in memory to steal credentials — exactly the kind of fileless intrusion a signature-only AV would miss.
In the Falcon console Neha opens the detection and reads the Threat Graph process tree: Outlook → PowerShell → in-memory execution → outbound connection, mapped to MITRE ATT&CK techniques. The IOA fired on the behaviour chain, not a file.
Falcon console ▸ Detections ▸ IOA ▸ Process tree (Threat Graph) ▸ Host ▸ MITRE ATT&CKNeha uses Network Containment to isolate the laptop (it keeps its link to the Falcon cloud), then RTR to kill the PowerShell process and remove the persistence entry. OverWatch corroborates it as hands-on-keyboard activity. Prevent had already blocked the worst payload; she confirms the user's credentials are reset.
Re-check the host: the malicious process is gone, no new IOAs fire, the process tree is clean, and the laptop is released from containment. The detection is closed as a true positive with the Threat Graph timeline attached as evidence.
Never answer a false-positive or update question with 'turn it off'. For a noisy prevention policy, investigate and tune the policy or add a targeted exclusion for that host group, keeping protection everywhere else. For sensor/content updates, stagger with sensor update policies (N-1, canary ring first) instead of pushing the latest to every machine at once.
What does Falcon Network Containment do to a compromised host?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does CrowdStrike say an Indicator of Attack catches a fileless intrusion that a hash blocklist would miss? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Falcon sensor (single agent)
- One lightweight cloud-native agent per endpoint that streams security telemetry to the CrowdStrike cloud — no on-prem server, no reboots, and the basis for every Falcon module.
- Threat Graph
- CrowdStrike's cloud graph database that ingests and correlates trillions of events from all protected endpoints in real time to detect threats and power threat intelligence.
- Falcon Prevent (NGAV)
- The next-gen antivirus / prevention layer that blocks malware and malware-free attacks at runtime using machine learning, exploit mitigation and Indicators of Attack.
- Falcon Insight (EDR)
- The endpoint detection and response layer that continuously records telemetry for detections, the process tree, visibility and retrospective threat hunting.
- IOA vs IOC
- An IOC is a known-bad artifact (hash, IP, domain) and is reactive; an IOA is the attacker's behaviour and intent regardless of the tool, catching novel, zero-day and fileless attacks.
- Falcon OverWatch
- CrowdStrike's human-led, 24/7 managed threat hunting team that proactively hunts stealthy, hands-on-keyboard intrusions and surfaces enriched detections to your team.
- Falcon Complete (MDR)
- Fully managed detection and response: CrowdStrike's team monitors, investigates, responds and remediates on your behalf, typically backed by a breach-prevention warranty.
- Real Time Response (RTR)
- A secure remote shell into an endpoint to investigate and remediate live — kill processes, pull or remove files, inspect the registry and run scripts.
- Network Containment
- Isolates a host from all network communication except its secured link to the Falcon cloud, stopping lateral spread while you investigate and run RTR, then release it.
📚 Sources
- CrowdStrike — The Falcon platform: cloud-native, single lightweight agent and the Threat Graph. crowdstrike.com/platform
- CrowdStrike — Falcon Prevent: next-generation antivirus (NGAV). crowdstrike.com/products/endpoint-security/falcon-prevent
- CrowdStrike — Falcon Insight: endpoint detection and response (EDR). crowdstrike.com/products/endpoint-security/falcon-insight-edr
- CrowdStrike — Indicators of Attack vs Indicators of Compromise (IOA vs IOC). crowdstrike.com/cybersecurity-101/indicators-of-attack
- CrowdStrike — Falcon OverWatch managed threat hunting and Falcon Complete MDR. crowdstrike.com/services
- CrowdStrike — Real Time Response and Network Containment for incident response. crowdstrike.com/products/endpoint-security/falcon-insight-edr
What's next?
Done with the interview prep? Go deeper on Falcon design — how the single sensor and Threat Graph are architected, how Prevent and Insight work, how the platform modules layer onto one agent, and how threat hunting and incident response run with OverWatch, RTR and network containment.