3.5 Find Hosts in RFM CCFA Practice Questions (Page 4)

Questions 16–17

1. 16foundation · easy

   Which of the following best describes the impact of Reduced Functionality Mode (RFM) on a host's protection?

   • AThe host is completely unprotected and the sensor stops all operations.
   • BThe host is fully protected but with slightly reduced performance.
   • CThe host is protected only against known threats, but not against new or unknown ones.
   • DThe host is not fully protected because the sensor's ability to enforce security policies is limited.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An administrator has identified a host in Reduced Functionality Mode. The 'RFM Reason' indicates a 'Sensor update failure'. The administrator has already tried reinstalling the sensor, but the host remains in RFM. What is the most likely next step to resolve this issue?

   • AContact CrowdStrike support to request a manual sensor update.
   • BReboot the host and wait for the sensor to retry the update.
   • CRemove the host from the Falcon console and re-add it to force a fresh sensor deployment.
   • DCheck the host's local sensor logs to identify the specific update failure and address the root cause.
   Reveal Solution Discussion Select an answer first