CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ79

VerifiedHost Management and Setup

What telemetry and protection remain available when a Linux host is operating in Reduced Functionality Mode (RFM)?

Explanation

On Linux, Reduced Functionality Mode stops the Falcon sensor from processing events and registering detections. The sensor continues to send heartbeat events to show that it remains installed, but it provides no protection.

Community Discussion

No comments yet. Be the first to start the discussion!