3.5 Find Hosts in RFM CCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which piece of information is displayed in the 'Reduced Functionality' section of a host's details page?

   • AThe reason the host entered RFM and the duration it has been in RFM.
   • BThe host's IP address and MAC address.
   • CThe list of security policies applied to the host.
   • DThe sensor's last update time.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which administrative action can an administrator take from the Falcon console to attempt to bring a host out of Reduced Functionality Mode?

   • AReboot the host from the console.
   • BDisable and re-enable the host's network adapter.
   • CReinstall the sensor on the host.
   • DChange the host's group membership.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is planning a maintenance window during which a critical segment of the network will be isolated from the internet for several hours. The security team wants to understand the impact on the Falcon sensors installed on hosts in that segment. What is the most accurate expectation to communicate?

   • AThe sensors will automatically uninstall to prevent them from sending data over an unsecured network.
   • BThe sensors will stop all protection and the hosts will be completely unprotected during the outage.
   • CThe sensors will continue to operate normally, as they are designed to function fully offline.
   • DThe sensors will enter Reduced Functionality Mode and will not be able to receive detection updates or send telemetry until connectivity is restored.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A host in the Falcon console shows a status of 'Reduced Functionality'. The administrator opens the host's details page to investigate. Which piece of information on this page is most directly useful for determining why the host entered RFM?

   • AThe 'Last Seen' timestamp, which shows the last time the sensor communicated with the cloud.
   • BThe 'RFM Reason' field, which provides a specific code or description of the triggering event.
   • CThe 'Hostname' field, which helps identify the machine and its location in the network.
   • DThe 'Sensor Version' field, which indicates whether the sensor is outdated and needs an upgrade.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is reviewing their incident response plan. They want to ensure that if a host enters Reduced Functionality Mode, the appropriate team is notified immediately. What is the most effective way to achieve this in the Falcon console?

   • ASet up a scheduled report that lists all hosts in RFM and email it to the team daily.
   • BCreate a custom dashboard that displays hosts in RFM and check it regularly.
   • CManually check the Hosts page for RFM hosts at the start of each shift.
   • DConfigure a workflow or alert rule that triggers when a host's status changes to 'Reduced Functionality'.
   Reveal Solution Discussion Select an answer first