Custom IOA rules are defined using which syntax?
Answer(s): D
Regex guidelines https://falcon.crowdstrike.com/documentation/68/detection-and-prevention-policies#regex
With Custom Alerts, it is possible to __________.
Answer(s): B
The reporting interval is predefined and cannot be changed. You can only enable/disable the custom alert feature and add/remove recipient email client for the alert/detection.
How do you assign a Prevention policy to one or more hosts?
Answer(s): C
The administrator can assign a Prevention policy to one or more hosts by ensuring the hosts are in a group and assigning that group to a custom Prevention policy. This allows users to apply different prevention settings and options to different groups of hosts based on their needs and preferences. The other options are either incorrect or not applicable to assigning a Prevention policy.
[CrowdStrike Falcon User Guide], page 34.
You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?
The best way to ensure that a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers are not allowed to run in your environment is to use IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to “Block” and ensure that the prevention policy these computers are using includes the option for “Custom Blocking” under Execution Blocking. This will allow Falcon to block the execution of these hashes on the hosts using this policy. The other options are either incorrect or not efficient to achieve this goal.
[CrowdStrike Falcon User Guide], page 44.
Which exclusion pattern will prevent detections on a file at C:\Program Files\My Program\My Files\program.exe?
Answer(s): A
The exclusion pattern that will prevent detections on a file at C:\Program Files\My Program\MyFiles\program.exe is \Program Files\My Program\My Files*. This pattern will match any file under the My Files folder, including program.exe, and exclude them from detections. The other patterns are either incorrect or too broad to prevent detections on this specific file.
[CrowdStrike Falcon User Guide], page 37.
Post your Comments and Discuss CrowdStrike CCFA-200b exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFA-200b content, but please register or login to continue.