3.4 Explain the Impact of Reduced Functionality Mode (RFM) and Why It Might Be Caused CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common cause for a CrowdStrike Falcon sensor to enter Reduced Functionality Mode (RFM)?

   • AThe sensor's real-time protection is disabled by the administrator
   • BThe sensor's cloud connectivity is temporarily lost due to network issues
   • CThe host's operating system is not supported by the sensor version
   • DThe host has insufficient disk space for the sensor's log files
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A Falcon administrator is managing a fleet of hosts that have been in RFM for a week. The hosts are in a segmented network that only allows traffic to specific IP addresses. The sensor's kernel driver is loaded on all hosts. What is the most likely reason the hosts are still in RFM?

   • AThe sensor's kernel driver is not compatible with the hosts' operating system.
   • BThe sensor's local cache is full, preventing it from sending telemetry.
   • CThe hosts cannot reach the CrowdStrike cloud because the network only allows traffic to specific IP addresses.
   • DThe sensor's maintenance token has expired, preventing it from exiting RFM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Falcon administrator is evaluating the impact of RFM on a critical production server. Which statement best describes the security impact while the server is in RFM?

   • AThe server's protection is unaffected because RFM only affects reporting.
   • BThe server is completely unprotected because the sensor is not running.
   • CThe server's protection is enhanced because RFM reduces false positives.
   • DThe server may not be fully protected against new threats because the sensor's detection and prevention are reduced.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Falcon administrator is responding to a security incident on a host that is currently in RFM. What is the most important consideration when relying on this host for forensic evidence?

   • AThe host's firewall is disabled, allowing all traffic to pass.
   • BThe host's kernel driver is not loaded, so no security events were recorded.
   • CThe host may have incomplete telemetry and event logs due to RFM.
   • DThe host's event logs are encrypted and cannot be accessed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a typical operational impact on a sensor in Reduced Functionality Mode (RFM)?

   • AThe sensor automatically uninstalls itself from the host
   • BThe sensor stops collecting any event data
   • CThe sensor stops sending heartbeats to the Falcon cloud
   • DThe sensor cannot perform on-host prevention actions such as blocking or quarantining
   Reveal Solution Discussion Select an answer first