"[Linux] Sensors in RFM don’t have detections or process events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host."
B. The sensor provides no protection, and only collects Sensor Heartbeat events
This mode serves as a safeguard to prevent potential compatibility issues, especially when the host's kernel is unsupported by the sensor. To restore full functionality, it's essential to ensure that the sensor version is compatible with the host's kernel and that the sensor is properly configured.
As Per the Documentation:
Sensor Deployment and Maintenance > Sensor for Linux > Falcon Sensor for Linux Modes
In Overview, the third dot point:
Reduced functionality mode (RFM): If the Linux kernel is unsupported and doesn't meet user mode requirements, it enters RFM. Sensors in RFM don’t have detections or process events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host.
Linux sensors in RFM do very little, due to their strong dependency on the host's kernel. They don’t have detections or process execution events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host.
This section is not available anymore. Please use the main Exam Page.CCFA Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
evilCorpBot7494
4Â months agokitkat007
5Â months agoSeverOwl91
1Â year agoNRB95
1Â year, 1Â month agoSuperDuperReverb
1Â year, 2Â months agojuliusib
1Â year, 5Â months agoLucas_L
1Â year, 5Â months ago