Where can you find hosts that are in Reduced Functionality Mode?

Where can you find hosts that are in Reduced Functionality Mode?
A . Event Search
B . Executive Summary dashboard
C . Host Search
D . Installation Tokens

View Answer

Answer: C

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host’s sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.