ExamTopics Logo
Mail Us[email protected]
Menu
Crowdstrike Discussions
exam questions

Exam CCFA All Questions

View all questions & answers for the CCFA exam
Go to Exam

Exam CCFA topic 1 question 215 discussion

Actual exam question from CrowdStrike's CCFA
Question #: 215
Topic #: 1
[All CCFA Questions]

What happens when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?

  • A. RFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled.
  • B. RFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.
  • C. RFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon
  • D. RFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by Duke_CT at May 20, 2025, 2:57 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
aN0omY
1 week, 4 days ago
Selected Answer: B
as per documentation. rmf on linux has to do with compatibility safe mode. dont have detectinos or process events but continue sending sensorheartbeat events to indicate sensor is installed on host
upvoted 1 times
...
CiscoNoahexamtopic
1 week, 4 days ago
Selected Answer: B
Sensors in RFM don’t have detections or process events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host.
upvoted 1 times
...
Duke_CT
3 weeks, 6 days ago
Selected Answer: A
The correct answer is< C. Uninstall and Maintenance Protection Explanation: In the Sensor Update Policy is what prevents unauthorized users from uninstalling the sensor. When this setting is enabled, it typically requires a token or elevated permissions to uninstall or tamper with the sensor, thereby protecting it from unauthorized removal.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel