CrowdStrike Certified Falcon Administrator (CCFA) — Question 106

When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?

Answer options

• A. The sensor would provide minimal protection
• B. The sensor provides no protection, and only collects Sensor Heart Beat events
• C. The sensor would function as normal
• D. The sensor would provide protection as normal, without event telemetry

Correct answer: B

Explanation

The correct answer is B because in Reduced Functionality Mode, the sensor does not provide any protective measures but continues to log Sensor Heart Beat events. Options A, C, and D incorrectly suggest that there is some level of protection or normal functionality, which is not the case in RFM.