A security team notices that several endpoints are in Reduced Functionality Mode (RFM) within the Falcon console. They want to understand why this…

Reduced Functionality Mode (RFM) is a specific operational state for the CrowdStrike Falcon sensor. It is triggered when the sensor has been unable to communicate with the Falcon cloud for a continuous period of 30 days. This mode is a fail-safe designed to prevent an unmanaged sensor with outdated prevention policies from causing potential business disruption by blocking legitimate applications or processes. While in RFM, the sensor ceases all prevention activities but continues to record detection events locally, which will be uploaded if connectivity is restored.

A. Manually disabling the sensor's kernel extension would likely result in a sensor tampering alert or an offline status, not the specific RFM state.

C. An End-of-Life (EOL) sensor is flagged in the console for its unsupported version but does not automatically enter RFM; it continues to operate on its last known policy.

D. The Falcon agent will typically fail to install or run correctly on an unsupported operating system, preventing it from ever reaching a managed state like RFM.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows: Reduced Functionality Mode. CrowdStrike Support Portal Documentation. This document explicitly states

"Reduced Functionality Mode (RFM) is a state that the Falcon sensor for Windows enters after it has been offline for 30 days... In this state

the sensor will no longer take any blocking or prevention actions."

2. CrowdStrike

Inc. (2023). Host and Host Group management. Falcon Platform Documentation. In the section detailing host statuses

it is clarified that the RFM state is directly tied to a prolonged loss of communication

distinguishing it from other states like offline

EOL

or uninstalled.

3. SANS Institute. (2022). Endpoint Protection and Response. Courseware for FOR508: Advanced Incident Response

Threat Hunting

and Digital Forensics. The course materials discuss various states of modern EDR agents

noting that cloud-managed sensors often enter a passive or reduced-functionality state after extended periods offline to avoid "bricking" a host with stale policies

aligning with the RFM concept.