CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ63

VerifiedHost Management and Setup

A Windows host on your network is in Reduced Functionality Mode (RFM). While the system remains in RFM, which of the following is true?

Explanation

On Windows, Reduced Functionality Mode preserves monitoring, event reporting, and detection at reduced capacity. Because the sensor is temporarily unhooked from certain kernel elements, some detection patterns are unavailable and a limited number of preventions are not triggered.

Community Discussion

No comments yet. Be the first to start the discussion!