3.4 Explain the Impact of Reduced Functionality Mode (RFM) and Why It Might Be Caused CCFA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What operational limitation does a Falcon sensor experience in Reduced Functionality Mode (RFM)?

   • AThe sensor cannot be managed by the Falcon console
   • BThe sensor cannot load its kernel driver and therefore cannot perform kernel-level operations
   • CThe sensor cannot communicate with the Falcon cloud
   • DThe sensor cannot send any telemetry to the Falcon console
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A Falcon administrator is investigating a host that entered RFM after a recent kernel update. The sensor's kernel driver is loaded, and the host can reach the internet. What is the most likely cause of RFM in this scenario?

   • AThe kernel update blocked the sensor's cloud communication.
   • BThe kernel update introduced a compatibility issue with the sensor's driver.
   • CThe kernel update disabled the sensor's local cache.
   • DThe kernel update changed the driver's signature, causing the sensor to enter RFM.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is typically required for a CrowdStrike Falcon sensor to exit Reduced Functionality Mode (RFM)?

   • AReinstalling the operating system
   • BDisabling other security software permanently
   • CRebooting the host to allow the sensor to reload its kernel driver
   • DRestarting the Falcon console service
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which scenario would most likely cause a CrowdStrike Falcon sensor to enter Reduced Functionality Mode (RFM)?

   • AThe sensor's cloud connection is slow due to high latency
   • BThe sensor's event log reaches its maximum size
   • CThe host is rebooted after a Windows update
   • DA new application is installed that conflicts with the sensor's kernel driver
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A Falcon administrator is managing a host that is in RFM. The host is a domain controller, and the sensor's kernel driver is loaded, but the sensor cannot communicate with the CrowdStrike cloud. What is the most important security consideration for this host?

   • AThe host's security is enhanced because RFM reduces false positives.
   • BThe host's security is unaffected because RFM only affects reporting.
   • CThe host may be vulnerable to threats because the sensor's detection and prevention are reduced.
   • DThe host is still protected against threats because the sensor is running.
   Reveal Solution Discussion Select an answer first