CCFA-200B: CrowdStrike Certified Falcon AdministratorDemo

By CrowdStrike · Question Mode

QuestionQ47

Policy Application

Which Windows prevention-policy setting monitors shell contents for the execution of malicious content?

  • A Script-based execution visibility
  • B Suspicious Scripts and Commands
  • C Enhanced exploitation visibility
  • D Additional user mode data visibility
Explanation

Script-based execution visibility provides Falcon sensor visibility into suspicious scripts and scripting-language content on supported Windows hosts; it is the control used to inspect script execution. Suspicious Scripts and Commands is a separate execution-blocking control that relies on Interpreter-Only and/or Script-Based Execution Monitoring visibility.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!