Exam CCFA-200b Topic 2 Question 105 Discussion

Actual exam question for CrowdStrike's CCFA-200b exam
Question #: 105
Topic #: 2

You have 100 hashes that have been prohibited by management and need to be blocked within your organization.
Using Falcon, what is the best way to accomplish this?

A. Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as a CSV file. Set the action to "Block and Alert." Verify the option for Custom Blocking inside Execution Blocking is active. B. Navigate to Configure > IOC Management. Inside this dashboard, add a custom IOAdd the list of hashes. Set the action to Block. Verify the prevention policy includes Custom Blocking under Execution Blocking. C. Navigate to Configure > IOC Management. Inside this dashboard, add a custom Prevention Policy. Add the list of hashes. Set the action to Block. Verify the policy includes Custom Execution Blocking. D. Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as CSV file. Set the action to "Block." Verify the option for Custom Execution Blocking is active.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business