3.4 Explain the Impact of Reduced Functionality Mode (RFM) and Why It Might Be Caused CCFA Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A Falcon administrator is troubleshooting a host that is in RFM. The host's kernel driver is loaded, and the sensor can reach the CrowdStrike cloud. However, the sensor is still in RFM. What is the most likely remaining cause?

   • AThe sensor's local cache is corrupted.
   • BThe sensor's cloud communication is intermittent.
   • CThe sensor's kernel driver is loaded but not functioning correctly.
   • DThe sensor's local security policy is misconfigured.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A Falcon administrator is managing a host that is in RFM. The host is running a critical application that cannot be interrupted. The sensor's kernel driver is loaded, and the sensor can reach the cloud. What is the best course of action to restore full protection without disrupting the application?

   • ADisable the critical application temporarily to allow the sensor to recover.
   • BReinstall the sensor while the application is running.
   • CReboot the host to force the sensor to reload.
   • DWait for the sensor to exit RFM automatically, as it is already communicating with the cloud.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is most likely to help a Falcon sensor recover from Reduced Functionality Mode (RFM)?

   • AUpdating the sensor to a version that supports the host's operating system
   • BChanging the sensor's cloud communication port
   • CIncreasing the host's memory allocation
   • DClearing the sensor's local cache
   Reveal Solution Discussion Select an answer first
5. 19expert · medium · select all that apply

   A Falcon administrator is troubleshooting a host that has been in RFM for several days. The sensor's kernel driver is loaded, and the host can reach the internet. Select all the conditions that must be met for the sensor to exit RFM.

   • AThe host must be rebooted.
   • BThe sensor's kernel driver must be loaded and functioning correctly.
   • CThe sensor must be able to communicate with the CrowdStrike cloud.
   • DThe sensor's local cache must be cleared.
   • EThe sensor's configuration must be reset to default.
   Check answers Discussion Select an answer first
6. 20application · medium

   A Falcon administrator is reviewing a host that entered RFM after a sensor update. The update was interrupted and the sensor's files may be corrupted. What is the most likely cause of RFM in this scenario?

   • AThe sensor's cloud communication was blocked by a firewall.
   • BThe sensor's local cache is full, preventing it from functioning normally.
   • CThe sensor's installation is incomplete or corrupted due to the interrupted update.
   • DThe sensor's kernel driver is outdated and incompatible with the OS.
   Reveal Solution Discussion Select an answer first