CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ146

VerifiedPolicy Application

You have a new patch server that must remain reachable while hosts in your environment are network-contained. The server has a static IP address that will not change. Which of the following is the best way to update the Containment Policy to permit this?

Explanation

A containment-policy allowlist should use the most specific stable network identifier available. Allowlisting the patch server’s individual static IP address permits communication with that server while avoiding unnecessary access to every system in its /24 network.

Community Discussion

No comments yet. Be the first to start the discussion!