CCIS: CrowdStrike Certified Identity Specialist

By CrowdStrike · Question Mode

QuestionQ24

VerifiedRisk Management with Policy Rules

Question Image

Given the detection exclusion shown, which option correctly explains how it applies to the “Suspicious protocol implementation (pass the hash)” detection?

Explanation

The enabled exclusion suppresses the detection when the destination is a domain controller, the initiating user belongs to Domain Admins, and the source host has a Zero Trust Assessment score from 90 through 100.

Community Discussion

No comments yet. Be the first to start the discussion!