CCFA-200B: CrowdStrike Certified Falcon AdministratorDemo

By CrowdStrike · Question Mode

QuestionQ73

Policy Application

Your management has prohibited 100 hashes that must be blocked across the organization.

Using Falcon, what is the best way to achieve this?

  • A Navigate to Configure > IOC Management. Inside this dashboard, add a custom IOC. Add the list of hashes. Set the action to Block. Verify the prevention policy includes Custom Blocking under Execution Blocking.
  • B Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as CSV file. Set the action to Block. Verify the option for Custom Execution Blocking is active.
  • C Navigate to Configure > IOC Management. Inside this dashboard, add a custom Prevention Policy. Add the list of hashes. Set the action to Block. Verify the policy includes Custom Execution Blocking.
  • D Navigate to Configure > Prevention policies. Inside this dashboard, add an IOC Policy. Add the list of hashes as a CSV file. Set the action to Block and Alert. Verify the option for Custom Blocking inside Execution Blocking is active.
Explanation

Falcon uses custom IOCs in IOC Management to define prohibited file hashes and assign the Block action. The endpoint prevention policy must also have Custom Blocking enabled under Execution Blocking so that those custom hash IOCs are enforced.

Community Discussion

No comments yet. Be the first to start the discussion!