CCFA-200B: CrowdStrike Certified Falcon AdministratorDemo

By CrowdStrike · Question Mode

QuestionQ39

Rules Configuration

Under what circumstances would the No Action option be assigned to a hash in IOC Management?

  • A When you want to save the indicator for later action, but do not want to block or allow it at this time
  • B There is no such option as No Action available in the Falcon console
  • C When you want to add the indicator to your allowlist, but not detect it
  • D When you want to add the indicator to your blocklist and show it as a detection
Explanation

The no_action custom-IOC action retains the hash indicator without allowing it, blocking it, or generating a detection. It is therefore appropriate when the indicator should be kept for future use but no action should currently be applied.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!