3.4 Explain the Impact of Reduced Functionality Mode (RFM) and Why It Might Be Caused CCFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of Reduced Functionality Mode (RFM) in CrowdStrike Falcon?

   • ATo allow the sensor to operate in a stealth mode to avoid detection by malware
   • BTo disable all security features until the sensor is manually reconfigured
   • CTo maintain a baseline level of protection when the sensor cannot fully function
   • DTo reduce the sensor's resource usage on low-end hardware
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon administrator notices that several hosts entered RFM after a recent group policy update. The update changed the Windows Firewall rules. What is the most likely cause of RFM in this scenario?

   • AThe group policy update disabled the sensor's kernel driver.
   • BThe firewall rules blocked the sensor's communication with the CrowdStrike cloud.
   • CThe firewall rules prevented the sensor from loading its kernel driver.
   • DThe group policy update changed the sensor's local cache location.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon administrator notices that a Windows server has been in Reduced Functionality Mode (RFM) for several hours. The server's kernel driver failed to load during a recent reboot. What is the most likely reason the sensor entered RFM?

   • AThe host was rebooted without a valid sensor maintenance token.
   • BThe sensor's local security policy was misconfigured by an administrator.
   • CThe sensor could not establish a connection to the CrowdStrike cloud.
   • DThe sensor's kernel driver failed to load, preventing the sensor from functioning normally.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon administrator is troubleshooting a host that entered RFM after a network outage. While the host is in RFM, which security capability is most likely to be affected?

   • AThe sensor will stop all security monitoring and prevention until it exits RFM.
   • BThe sensor will only be able to perform prevention, not detection, while in RFM.
   • CThe sensor will have reduced detection and prevention capabilities, potentially missing threats until full functionality is restored.
   • DThe sensor will continue to detect and prevent threats locally, but cloud-based detections will be delayed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Falcon administrator is reviewing a host that has been in RFM for the past hour. Which operational limitation is the administrator most likely to observe on that host?

   • AThe sensor will not send real-time telemetry to the CrowdStrike cloud.
   • BThe sensor will automatically reboot the host to attempt recovery.
   • CThe sensor will only allow administrative commands to be executed on the host.
   • DThe sensor will continue to block malicious processes but will not log them.
   Reveal Solution Discussion Select an answer first