CrowdStrike
CCFA-200B · Question #202
There are a significant number of false positive detections from your developers that are getting blocked and quarantined by Falcon. What Indicator of Compromise (IOC) action would be the best option?
The correct answer is C. Detect Only (displayed as Detect only in the console). Explanation/Reference:
Detection and Prevention Management
Question
There are a significant number of false positive detections from your developers that are getting blocked and quarantined by Falcon. What Indicator of Compromise (IOC) action would be the best option?
Options
- ANo_action (displayed as None in the console)
- BAllow (displayed as Allow in the console)
- CDetect Only (displayed as Detect only in the console)
- DPrevent (displayed as Blocked in the console)
How the community answered
(34 responses)- A6% (2)
- B9% (3)
- C71% (24)
- D15% (5)
Explanation
Explanation/Reference:
Topics
#IOC actions#false positives#detection tuning#developer exclusions
Community Discussion
No community discussion yet for this question.