CrowdStrike Certified Falcon Administrator (CCFA) — Question 22

What is the most common cause of a Windows Sensor entering Reduced Functionality Mode (RFM)?

Answer options

• A. Falcon console updates are pending
• B. Falcon sensors installing an update
• C. Notifications have been disabled on that host sensor
• D. Microsoft updates

Correct answer: D

Explanation

The primary reason a Windows Sensor enters Reduced Functionality Mode is due to the absence of necessary Microsoft updates, which can affect its operational capacity. Other options, such as Falcon console updates or sensor updates, do not directly trigger RFM, and disabling notifications does not impact the sensor's functionality.