When would the No Action option be assigned to a hash in IOC Management?

The correct answer is A. When you want to save the indicator for later action, but do not want to block or allow it at this. The No Action option can be assigned to a hash in IOC Management when you want to save the indicator for later action, but do not want to block or allow it at this time. This option will neither detect nor prevent the execution of the hash, but will keep it in the IOC list for…

Prevention Policy and IOC Management

Question

Options

AWhen you want to save the indicator for later action, but do not want to block or allow it at this
BAdd the indicator to your allowlist and do not detect it
CThere is no such option as No Action available in the Falcon console
DAdd the indicator to your blocklist and show it as a detection

How the community answered

(49 responses)

A
90% (44)
B
4% (2)
C
2% (1)
D
4% (2)

Explanation

The No Action option can be assigned to a hash in IOC Management when you want to save the indicator for later action, but do not want to block or allow it at this time. This option will neither detect nor prevent the execution of the hash, but will keep it in the IOC list for future reference. The other options are either incorrect or not related to the No Action option.

Topics

#IOC Management#No Action option#indicator management#hash disposition

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice