3.5 Find Hosts in RFM CCFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the Falcon console, where would an administrator go to find a list of hosts currently in Reduced Functionality Mode (RFM)?

   • AThe Sensor Updates page, under the 'RFM' tab.
   • BThe Detections page, filtering by 'RFM' in the detection type.
   • CThe Hosts page, using the 'Reduced Functionality' filter.
   • DThe Event Search page, using the 'RFM' event type.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which filter option on the Hosts page would an administrator use to display only hosts that are currently in Reduced Functionality Mode?

   • ASensor Version
   • BStatus
   • CPlatform
   • DReduced Functionality
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A host has been in Reduced Functionality Mode for several days. The administrator is looking at the host details page and sees the 'RFM Reason' field is populated with 'Sensor heartbeat missed'. What does this reason indicate about the host?

   • AThe sensor has not been able to send its regular heartbeat signal to the cloud, indicating a communication problem.
   • BThe sensor has detected a critical vulnerability on the host and has entered a protective state.
   • CThe host has been inactive and the sensor has gone into a power-saving mode.
   • DThe sensor has been manually placed into RFM by an administrator for maintenance.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A host has entered Reduced Functionality Mode, and the 'RFM Reason' is 'Sensor version too old'. The administrator needs to bring the host out of RFM. What is the most appropriate action?

   • AUpdate the sensor to the latest version using the Falcon console's sensor update feature.
   • BRemove the host from the console and re-add it to trigger a fresh sensor deployment.
   • CReinstall the sensor with the same version to refresh its configuration.
   • DReboot the host to force the sensor to check for updates automatically.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the recommended first step an administrator should take when a host is in Reduced Functionality Mode due to a suspected sensor integrity issue?

   • AChange the host's prevention policy to a less restrictive one.
   • BIgnore the RFM status and continue monitoring.
   • CUninstall the sensor and leave the host unprotected.
   • DReinstall the sensor to restore its integrity.
   Reveal Solution Discussion Select an answer first