3.5 Find Hosts in RFM CCFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of Reduced Functionality Mode (RFM) in CrowdStrike Falcon?

   • ATo automatically uninstall the sensor when a critical error is detected.
   • BTo reduce the sensor's network bandwidth usage by disabling cloud communication.
   • CTo allow the sensor to continue operating with reduced capabilities when it cannot verify the integrity of its own components.
   • DTo temporarily disable the sensor's protection features while preserving system performance.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   An administrator is managing a fleet of 500 hosts. A recent network change has caused 50 hosts to enter Reduced Functionality Mode. The administrator needs to identify the affected hosts and determine the common cause. What is the most efficient approach?

   • AGenerate a report on sensor health and review the RFM hosts listed in the report.
   • BUse the Hosts page to filter by 'Reduced Functionality' status, then review the 'RFM Reason' on a few host details pages to identify a pattern.
   • CContact CrowdStrike support to provide a list of all hosts in RFM.
   • DUse the Investigate page to search for events related to RFM across all hosts.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A host has been in Reduced Functionality Mode for two weeks. The 'RFM Reason' is 'Sensor not reporting'. The administrator has already reinstalled the sensor twice, but the host remains in RFM. The host is a critical production server that cannot be rebooted during business hours. What is the most appropriate next step?

   • ASchedule a maintenance window to reboot the host and then reinstall the sensor.
   • BRemove the host from the Falcon console and re-add it to force a fresh sensor deployment.
   • CLeave the host in RFM and monitor it, as it may recover on its own.
   • DContact CrowdStrike support for advanced troubleshooting, as the issue may be deeper than a simple sensor problem.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   On a host's details page in the Falcon console, where would an administrator find the reason a host entered Reduced Functionality Mode?

   • AIn the 'Network' section, under 'Connection Status'.
   • BIn the 'Reduced Functionality' section, which displays the reason and duration.
   • CIn the 'Activity' tab, under 'RFM Events'.
   • DIn the 'Sensor Health' section, under 'RFM Reason'.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A large enterprise has a segmented network with several hosts in Reduced Functionality Mode. The 'RFM Reason' for all affected hosts is 'Network connectivity issue'. The network team has confirmed that a firewall misconfiguration is blocking traffic to the CrowdStrike cloud. The administrator needs to resolve the issue and bring the hosts out of RFM. What is the most important first step?

   • AReinstall the sensors on all affected hosts to force them to re-establish communication.
   • BContact CrowdStrike support to manually clear the RFM state on the affected hosts.
   • CReboot all affected hosts to clear the RFM state.
   • DFix the firewall misconfiguration to restore connectivity to the CrowdStrike cloud.
   Reveal Solution Discussion Select an answer first