CrowdStrike Certified Falcon Administrator (CCFA) — Question 164

What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?

Answer options

• A. RFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled.
• B. RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.
• C. RFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon
• D. RFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console

Correct answer: B

Explanation

The correct answer is B because in Reduced Functionality Mode (RFM), the sensors stop processing events and detections entirely, only sending basic status information to the Falcon Console. Option A is incorrect as it suggests event processing is disabled but still sends detection information, which is not the case. Option C is wrong because it states that log data is still sent, which does not happen in RFM. Option D is misleading as it implies that existing policies are processed, which is not allowed in RFM.