CCFA-200B · Question #102
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you…
The correct answer is B. Using IOC Management, add the hash of the binary in question and set the action to "Allow". to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.
Question
You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?
Options
- AContact support and request that they modify the Machine Learning settings to no longer include
- BUsing IOC Management, add the hash of the binary in question and set the action to "Allow"
- CUsing IOC Management, add the hash of the binary in question and set the action to "Block, hide
- DUsing IOC Management, add the hash of the binary in question and set the action to "No Action"
How the community answered
(27 responses)- A7% (2)
- B78% (21)
- C11% (3)
- D4% (1)
Explanation
to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.
Topics
Community Discussion
No community discussion yet for this question.