Free Preparation Discussions
MENU
CrowdStrike Exam CCFA-200 Topic 2 Question 50 Discussion
Topic #: 2
The Falcon Administrator has created a new prevention policy to apply to the "Servers" group; however, when applying the new prevention policy this group is not appearing in the list of available groups. What is the most likely issue?
The option that is true when a Windows host is in Reduced Functionality Mode (RFM) is that some detection patterns and preventions will not be triggered. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Windows sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the %TEMP% directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon cloud. This means that some detection patterns and preventions that rely on telemetry, machine learning, or cloud analysis will not be triggered.
Marla
1 months agoLynsey
1 months agoGene
2 days agoHershel
8 days agoVeronica
14 days agoHelene
1 months agoKimberlie
24 days agoCorazon
29 days agoMiriam
1 months agoElena
2 months agoZachary
1 months agoEloisa
1 months agoLaurel
2 months agoLeonora
2 months agoBarbra
2 months agoLamonica
3 months ago