CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ71

VerifiedRules Configuration

Your development team is building a new enterprise application, but Falcon begins generating alerts during testing. The alert references C:\Users\Bob\DevCode\felix.dll. The detection shows that it is triggered only by a particular Falcon IOA.

What action should be taken to resolve this issue?

Explanation

An IOA exclusion for C:\Users\Bob\DevCode\felix.dll suppresses the specific behavioral IOA detection responsible for the alert while leaving other Falcon protections in place. File exclusions and Allow custom IOCs do not exclude an IOA detection, and applying a less restrictive policy to all development systems is broader than necessary.

Community Discussion

No comments yet. Be the first to start the discussion!