An organization has a custom IOM rule in Falcon Cloud Security to detect SSH connections from unauthorized IP addresses. However, the security team needs to update the rule to exclude a newly added…

Question

Options

• ADelete the existing IOM rule and create a new one with the updated IP range.
• BUse the Falcon CLI to modify the IOM rule in the underlying infrastructure.
• CEdit the IOM rule directly in the Falcon Cloud Security Console.
• DDisable the IOM rule and configure AWS Security Groups to handle IP whitelisting instead.

• A
  4% (1)
• B
  11% (3)
• C
  81% (22)
• D
  4% (1)

Explanation

Option A: Deleting and recreating the rule is inefficient and could lead to downtime or loss of historical data. The rule should be edited instead. Option B: There is no CLI functionality for modifying IOM rules in Falcon Cloud Security. All IOM rule management is handled through the console. Option C: Falcon Cloud Security provides a straightforward interface for editing existing custom IOM rules, including modifying IP ranges or other parameters. Option D: AWS Security Groups are not a replacement for Falcon Cloud Security's IOM rules. Security Groups are limited to network-level access control and do not offer the runtime detection capabilities of IOM rules.

No community discussion yet for this question.