Exam CCFR-201 topic 1 question 17 discussion

Answer A, A. Glob Syntax Globs in the Falcon console Glob wildcards offer flexibility when file names and directory structures vary across multiple hosts. For example, wildcards can match partial file names or match file names regardless of what directory they’re in. Features that support globs: Prevention policy exclusions. For more info, see Understanding prevention policy exclusions. Falcon FileVantage file integrity monitoring rules and scheduled exclusions. For more info, see Falcon FileVantage. Falcon Firewall wildcard IFN rules. For more info, see Manage your firewall rules and rule groups. Falcon USB Device Control serial numbers used to create prevention policy exceptions. For more info, see USB Device Control. Reference : In 2024, the Advanced event search will use the CrowdStrike Query Language (CQL).

Answer A, A. Glob Syntax Globs in the Falcon console Glob wildcards offer flexibility when file names and directory structures vary across multiple hosts. For example, wildcards can match partial file names or match file names regardless of what directory they’re in. Features that support globs: Prevention policy exclusions. For more info, see Understanding prevention policy exclusions. Falcon FileVantage file integrity monitoring rules and scheduled exclusions. For more info, see Falcon FileVantage. Falcon Firewall wildcard IFN rules. For more info, see Manage your firewall rules and rule groups. Falcon USB Device Control serial numbers used to create prevention policy exceptions. For more info, see USB Device Control. Reference : In 2024, the Advanced event search will use the CrowdStrike Query Language (CQL).

Correct is A Correction: IOA = Regex Sensor Visibility = Glob Syntax

The correct answer for Sensor Visibility Exclusion patterns in Crowdstrike is: C. RegEx (Regular Expressions) https://www.crowdstrike.com/blog/tech-center/custom-ioas/

It's A

Checked on UI

checked in docs