CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ21

VerifiedHunting Methodology

Your organization relies on an internally developed application for operations. The application is generating Indicators of Attack (IOA) detections for vulnerable-driver use on servers where Falcon was recently installed. After reviewing the application, you determine that its behavior is expected.

What will reduce risk in the environment the most?

Explanation

Updating a vulnerable driver to a current, non-vulnerable version removes the underlying component that can be exploited. Detection exclusions, machine-learning exclusions, and sensor-visibility exclusions may reduce alerts or telemetry, but they do not remediate the vulnerable driver or its associated risk.

Community Discussion

No comments yet. Be the first to start the discussion!