To enhance your security, you want to detect and block based on a list of domains and IP addresses. How can you use IOC management to help this objective?

Question

Options

• ABlocking of Domains and IP addresses is not a function of IOC management. A Custom IOA Rule
• BUsing IOC management, import the list of hashes and IP addresses and set the action to Detect
• CUsing IOC management, import the list of hashes and IP addresses and set the action to
• DUsing IOC management, import the list of hashes and IP addresses and set the action to No

• A
  76% (37)
• B
  6% (3)
• C
  4% (2)
• D
  14% (7)

Explanation

IOC management only allows "Detect only" and "No Action" among the possible actions. Therefore, it cannot be used to block based on IPs or domains. Custom IOA Rule groups allow to create rule types based on Network Connection (configuring a remote IP address) and domains, and gives the options to "Monitor", "Detect" and "Kill Process", being the late one the closest to

No community discussion yet for this question.