You have a Windows host on your network in Reduced functionality mode (RFM). While the system is in RFM, which of the following is TRUE?

A Windows host enters Reduced Functionality Mode (RFM) when the Falcon sensor has been unable to communicate with the CrowdStrike cloud for 14 consecutive days. While in RFM, the sensor continues to protect the host using its last-known prevention policy and locally cached detection patterns. However, it cannot receive updated threat intelligence, new prevention policies, or leverage cloud-based machine learning for analysis. This means that while existing local protections remain active, newer threats and detection patterns that rely on cloud connectivity will not be triggered, resulting in a "reduced" security posture.

A. System monitoring will be unavailable This is incorrect. The sensor continues to monitor local system activity to enforce its last-known prevention policy.
B. Event reporting will be unavailable This is incorrect. The sensor continues to generate and queue event data locally. Reporting to the cloud is suspended but resumes once connectivity is restored.
C. Prevention patterns will not be triggered This is incorrect. The sensor will continue to trigger preventions based on the policies and patterns that were locally cached before it lost connection to the cloud.

1. CrowdStrike, Inc. (2023). Falcon Sensor for Windows Deployment Guide. Document Version 6.54. "Sensor states and updates" section. This guide explains that in RFM, the sensor "continues to enforce the last known prevention policy," but "detections that rely on cloud analysis will not occur." This directly supports that some, but not all, detections and preventions will be unavailable.

2. CrowdStrike, Inc. (2023). Falcon Platform UI Documentation. "Hosts App > Host Management" section. The documentation details the sensor status indicators, including RFM. It clarifies that RFM status indicates the sensor is operating with a stale policy and cannot perform cloud-dependent actions, confirming that its functionality is degraded, not completely disabled.