CCFA-200B: CrowdStrike Certified Falcon Administrator

Question

A substantial number of false-positive detections involve a binary used by developers in your organization. The binary has identical SHA256 values across those detections.

Which exclusion action should be taken?

Explanation

An IOC management exclusion can target the binary’s SHA256 hash, suppressing false-positive detections for that exact known file across all occurrences. Path-based machine-learning exclusions do not reliably cover the same binary in different locations, and reducing sensor visibility would remove broader telemetry unnecessarily.

CCFA-200B: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ140

Community Discussion