CrowdStrike CCFR-201b Exam - Topic 1 Question 2 Discussion

Actual exam question for CrowdStrike's CCFR-201b exam

Question #: 2
Topic #: 1

[All CCFR-201b Questions]

Where can you find hosts that are in Reduced Functionality Mode?

AEvent Search

BExecutive Summary dashboard

CHost Search

DInstallation Tokens

Show Suggested Answer

Suggested Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1.You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1.You can also view details about why a host is in RFM by clicking on its hostname1.

by Barney at Jan 23, 2026, 10:16 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Maile

1 month ago

I’m leaning towards C) Host Search as well. It’s where you’d check host status.

upvoted 0 times

...

Queen

2 months ago

B) Executive Summary dashboard sounds right. It gives a good overview.

upvoted 0 times

...

Simona

2 months ago

I feel like A) Event Search could work too.

upvoted 0 times

...

Marvel

2 months ago

I think it's C) Host Search. Seems logical.

upvoted 0 times

...

Stephanie

3 months ago

Reduced Functionality Mode? Sounds kinda vague, not sure about this.

upvoted 0 times

...

Rosendo

4 months ago

Nope, it's not in Installation Tokens, that's for sure.

upvoted 0 times

...

India

4 months ago

Wait, are you sure? I thought it was in the Executive Summary.

upvoted 0 times

...

Azzie

4 months ago

Totally agree, it's definitely C!

upvoted 0 times

...

Bea

4 months ago

You can find them in Host Search.

upvoted 0 times

...

Emilio

4 months ago

Ah, the age-old question: where do you find the hosts that are just a little less functional? The answer, my friends, is in the Host Search. It's like a Where's Waldo, but for slightly malfunctioning androids.

upvoted 0 times

...

Jacklyn

4 months ago

C) Host Search is the way to go. Unless you're looking for hosts in Increased Functionality Mode - then you'll need to check the Overclocked Hosts section.

upvoted 0 times

...

Mauricio

5 months ago

I'm pretty sure I saw some hosts in Reduced Functionality Mode at the Reduced Expectations Diner. Just a hunch.

upvoted 0 times

...

Phuong

5 months ago

I always get confused between Reduced Functionality Mode and Reduced Calorie Mode. Do they serve smaller portions of the hosts?

upvoted 0 times

...

Lauryn

5 months ago

C) Host Search is the correct answer.

upvoted 0 times

...

Julieta

5 months ago

Installation Tokens sounds familiar, but I can't recall if they actually show hosts in Reduced Functionality Mode.

upvoted 0 times

...

Delisa

5 months ago

I practiced a question similar to this, and I feel like Event Search could be a possibility too.

upvoted 0 times

...

Dannie

6 months ago

I remember something about the Executive Summary dashboard, but it feels like that was for overall system health, not specific hosts.

upvoted 0 times

...

Daron

6 months ago

I think Reduced Functionality Mode hosts might be listed in the Host Search, but I'm not entirely sure.

upvoted 0 times

...

Rima

6 months ago

I think the answer is C) Host Search. That's where I'd expect to find information about hosts in Reduced Functionality Mode. Feels like a pretty straightforward question.

upvoted 0 times

...

Ronny

7 months ago

I'm a bit confused on this one. I'm not sure if the answer is A, B, C, or D. I'll have to review my notes and try to figure out the best approach.

upvoted 0 times

...

Julieta

7 months ago

Okay, let me see. Reduced Functionality Mode is related to the host, so I'm guessing the answer is C) Host Search. That's where I'd start looking.

upvoted 0 times

...

Cheryl

7 months ago

Hmm, I'm not sure about this one. I'll need to think it through carefully. Maybe checking the Event Search or Executive Summary dashboard could give me a clue.

upvoted 0 times

...