CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ73

VerifiedPolicy Application

Your management has prohibited 100 hashes that must be blocked across the organization.

Using Falcon, what is the best way to achieve this?

Explanation

Falcon uses custom IOCs in IOC Management to define prohibited file hashes and assign the Block action. The endpoint prevention policy must also have Custom Blocking enabled under Execution Blocking so that those custom hash IOCs are enforced.

Community Discussion

No comments yet. Be the first to start the discussion!