CrowdStrike CCFR-201b Exam - Topic 1 Question 2 Discussion

Actual exam question for CrowdStrike's CCFR-201b exam

Question #: 2
Topic #: 1

[All CCFR-201b Questions]

Where can you find hosts that are in Reduced Functionality Mode?

AEvent Search

BExecutive Summary dashboard

CHost Search

DInstallation Tokens

Show Suggested Answer

Suggested Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1.You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1.You can also view details about why a host is in RFM by clicking on its hostname1.

by Barney at Jan 23, 2026, 10:16 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dannie

8 days ago

I remember something about the Executive Summary dashboard, but it feels like that was for overall system health, not specific hosts.

upvoted 0 times

...

Daron

13 days ago

I think Reduced Functionality Mode hosts might be listed in the Host Search, but I'm not entirely sure.

upvoted 0 times

...

Rima

18 days ago

I think the answer is C) Host Search. That's where I'd expect to find information about hosts in Reduced Functionality Mode. Feels like a pretty straightforward question.

upvoted 0 times

...

Ronny

23 days ago

I'm a bit confused on this one. I'm not sure if the answer is A, B, C, or D. I'll have to review my notes and try to figure out the best approach.

upvoted 0 times

...

Julieta

28 days ago

Okay, let me see. Reduced Functionality Mode is related to the host, so I'm guessing the answer is C) Host Search. That's where I'd start looking.

upvoted 0 times

...

Cheryl

1 month ago

Hmm, I'm not sure about this one. I'll need to think it through carefully. Maybe checking the Event Search or Executive Summary dashboard could give me a clue.

upvoted 0 times

...

Ailene

1 month ago

I think the answer is C) Host Search. That's where I'd look for hosts in Reduced Functionality Mode.

upvoted 0 times

...