Exam CCFA topic 1 question 54 discussion

Actual exam question from CrowdStrike's CCFA

Question #: 54
Topic #: 1

You have been provided with a list of 100 hashes that are not malicious but your company has deemed to be inappropriate for work computers. They have asked you to ensure that they are not allowed to run in your environment. You have chosen to use Falcon to do this. Which is the best way to accomplish this?

A. Using the Support Portal, create a support ticket and include the list of binary hashes, asking support to create an "Execution Prevention" rule to prevent these processes from running
B. Using Custom Alerts in the Investigate App, create a new alert using the template "Process Execution" and within that rule, select the option to "Block Execution"
C. Using IOC Management, gather the list of SHA256 or MD5 hashes for each binary and then upload them. Set all hashes to "Block" and ensure that the prevention policy these computers are using includes the option for "Custom Blocking" under Execution Blocking.
D. Using the API, gather the list of SHA256 or MD5 hashes for each binary and then upload them, setting them all to "Never Allow"

Show Suggested Answer

Suggested Answer: C 🗳️

by Jek88 at Feb. 17, 2023, 7:25 a.m.

Comments

Submit Cancel

sbag0024

11 months ago

Selected Answer: C

C is correct

upvoted 1 times

...

FerbOP

1 year ago

Selected Answer: C

C is correct

upvoted 1 times

...

Jek88

1 year, 2 months ago

C is the correct answer.

upvoted 1 times

...

Exam CCFA All Questions

View all questions & answers for the CCFA exam

Exam CCFA topic 1 question 54 discussion

Comments

sbag0024

FerbOP

Jek88

SY0-701