During a simulated training exercise with your security team, an analyst used Falcon to network contain a host. It was then discovered that containing this specific host interrupted some key business processes and resulted in lost revenue. As the Falcon Administrator, what can be done to prevent this interruption in the future?

Question

Accepted Answer

B. Configure your containment policy to allow the IP addresses for those key business processes so

Answer

A. Collaborate with the firewall engineers so that in the future, network containment would only deny

Answer

C. Add this Falcon host to your deny list so that it is never able to be network contained again

Answer

D. Educate the analyst so they can understand and memorize which hosts are safe to network

During a simulated training exercise with your security team, an analyst used Falcon to network contain a host. It was then discovered that containing this specific host interrupted some key…

Question

Options

How the community answered

Explanation

Topics

Community Discussion