CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ69

VerifiedRules Configuration

A significant number of false-positive detections from your developers are being blocked and quarantined by Falcon.

Which Indicator of Compromise (IOC) action is the best option?

Explanation

The Allow IOC action permits activity associated with the specified indicator, avoiding the blocking and quarantine of known false positives. Prevent continues to block, and Detect Only does not provide an allowlisting exception.

Community Discussion

No comments yet. Be the first to start the discussion!