nerdexam
CrowdStrike

CCFA-200B · Question #241

You need to create a rule to block all process executions of Telegram in your environment. Which custom IOA rule configuration would accomplish this?

The correct answer is B. Custom IOA rule set to Block Execution on an Image Filename of .*Telegram.*. You've hit your limit · resets 12:50am (America/New_York)

Detection and Prevention Policies

Question

You need to create a rule to block all process executions of Telegram in your environment. Which custom IOA rule configuration would accomplish this?

Options

  • ACustom IOA rule configuration cannot block non-malicious binaries from executing
  • BCustom IOA rule set to Block Execution on an Image Filename of .Telegram.
  • CCustom IOA rule set to Monitor on an Image Filename of .Telegram.
  • DCustom IOA rule set to Detect on an Image Filename of .Telegram.

How the community answered

(17 responses)
  • A
    6% (1)
  • B
    88% (15)
  • D
    6% (1)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

Topics

#Custom IOA rules#Process blocking#Image Filename#Rule actions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCFA-200B Practice