nerdexam
CrowdStrike

CCFA-200B · Question #102

You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you…

The correct answer is B. Using IOC Management, add the hash of the binary in question and set the action to "Allow". to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.

IOC Management and Detection Tuning

Question

You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?

Options

  • AContact support and request that they modify the Machine Learning settings to no longer include
  • BUsing IOC Management, add the hash of the binary in question and set the action to "Allow"
  • CUsing IOC Management, add the hash of the binary in question and set the action to "Block, hide
  • DUsing IOC Management, add the hash of the binary in question and set the action to "No Action"

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    78% (21)
  • C
    11% (3)
  • D
    4% (1)

Explanation

to match any number of characters including none while not matching beyond path separators (\ or /) and double asterisks are used to recursively match zero or more directories that fall under the current directory.

Topics

#IOC management#false positives#hash allowlist#ML detections

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice