Cyber Monday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location PL
Mob_nav_barsMENU

CrowdStrike Exam CCFA-200 Topic 13 Question 26 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam
Question #: 26
Topic #: 13
[All CCFA-200 Questions]

What is likely the reason your Windows host would be in Reduced Functionality Mode (RFM)?

Show Suggested Answer Hide Answer
Suggested Answer: B

The likely reason your Windows host would be in Reduced Functionality Mode (RFM) is that the host lost internet connectivity. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Windows sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the %TEMP% directory.The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud1. Losing internet connectivity is a common cause of RFM, as it prevents the sensor from communicating with the Falcon cloud. A misconfiguration in your prevention policy or sensor update policy will not cause RFM, as these policies are applied by the Falcon cloud and do not affect the sensor's license, network, or certificate status.Microsoft updates altering the kernel may cause compatibility issues with the sensor, but not RFM3.


by Taryn at Feb 09, 2024, 12:11 PM

Limited Time Offer

25%

Off

Get Premium CCFA-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Myra
7 months ago
That's a possibility too, we should consider all potential reasons.
upvoted 0 times
...
Whitley
7 months ago
Could it also be due to a Sensor Update Policy being misconfigured?
upvoted 0 times
...
Aileen
7 months ago
I agree, it's important to regularly check and update prevention policies.
upvoted 0 times
...
Myra
7 months ago
I think the reason could be a misconfiguration in the prevention policy.
upvoted 0 times
...

Save Cancel
az-700  pass4success  az-104  200-301  200-201  cissp  350-401  350-201  350-501  350-601  350-801  350-901  az-720  az-305  pl-300  

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77