CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ130

VerifiedRules Configuration

The security team is responding to a possible voice-phishing attempt involving an unapproved remote monitoring and management (RMM) tool.

What should be configured to prevent any future executions of the process?

Explanation

A Custom IOA can match process-related behavioral criteria, including process names, paths, and command lines, and supports a prevention action that terminates the offending process. ML and IOA exclusions suppress prevention or detection logic, while a Custom IOC is intended for static indicators rather than defining process-execution behavior.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!