Free Preparation Discussions
MENU
CrowdStrike Exam CCFA-200 Topic 2 Question 41 Discussion
Topic #: 2
You have a Windows host on your network in Reduced functionality mode (RFM). While the system is in RFM, which of the following is TRUE?
The option that is true when a Windows host is in Reduced Functionality Mode (RFM) is that some detection patterns and preventions will not be triggered. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Windows sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the %TEMP% directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud. This means that some detection patterns and preventions that rely on telemetry, machine learning, or cloud analysis will not be triggered.
Geoffrey
1 months agoVesta
1 months agoAnnice
2 months agoCarolann
9 days agoAmber
10 days agoMelda
11 days agoDavida
12 days agoShawn
13 days agoAndrew
1 months agoRodrigo
2 months agoAnna
11 days agoShelba
1 months agoBea
1 months agoPeggy
1 months agoAdrianna
2 months agoCordelia
1 months agoMarylin
1 months agoErick
2 months agoGeoffrey
2 months agoErasmo
2 months agoNoble
2 months agoKaycee
2 months ago