A host enters Reduced Functionality Mode (RFM) when its sensor cannot communicate with the CrowdStrike cloud for an extended period, typically 14 days. The most fundamental requirement for this communication is the ability to resolve the CrowdStrike cloud's Fully Qualified Domain Names (FQDNs) to their IP addresses via the Domain Name System (DNS). If DNS resolution fails due to a network misconfiguration (e.g., incorrect DNS server settings, firewall blocking DNS traffic), the sensor cannot initiate a connection. Therefore, checking DNS resolution is the most direct and effective initial step to diagnose a potential network configuration issue affecting multiple hosts.

A. A full system scan is a security operation to detect threats on the endpoint; it does not diagnose or test network connectivity to the CrowdStrike cloud.
B. While generating a diagnostic report is a valid troubleshooting step, it is primarily for collecting comprehensive data for CrowdStrike support to analyze, not the most direct method for an administrator to initially identify the issue.
C. Disabling endpoint firewalls tests only one specific cause of a network block. The issue could be a network firewall, proxy server, or DNS failure, which this action would not identify.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows Deployment Guide. CrowdStrike Support Portal Document.

Section: Troubleshooting

"Sensor communication issues"

Content: The guide specifies that for sensors to communicate

they must be able to connect to the CrowdStrike cloud over HTTPS (port 443). It explicitly states that a prerequisite for this is successful DNS resolution of the cloud hosts. Troubleshooting steps for connectivity consistently begin with verifying network prerequisites

including DNS and firewall rules.

2. CrowdStrike

Inc. (2023). Tech Center: Troubleshooting Sensor Connectivity. CrowdStrike Support Portal.

Article ID: Varies

but content is consistent.

Content: Official troubleshooting workflows for RFM or non-communicating sensors instruct administrators to first verify basic network connectivity from the affected endpoint. This includes using tools like nslookup or ping to confirm that the CrowdStrike cloud FQDNs (e.g.

ts01-b.cloudsink.net) can be resolved and reached. This confirms that DNS resolution is a primary and initial diagnostic step.

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 2: Application Layer

Section 2.2 "The Web and HTTP" and Section 2.5 "DNS—The Internet’s Directory Service".

Content: This foundational university textbook explains that before an HTTP (or HTTPS) connection can be established to a server identified by a hostname

the client must first use DNS to resolve the hostname into an IP address. This academic principle underpins why checking DNS (Option D) is the most fundamental step in troubleshooting connectivity to a cloud service.