nerdexam
CrowdStrike

CCFA-200B · Question #55

When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?

The correct answer is A. *\.baddomain\.xyz|baddomain\. xyz. The syntax that would be best for detecting or preventing on all subdomains as well is .baddomain.xyz|baddomain. xyz. This syntax will match any domain that ends with .baddomain.xyz or is exactly baddomain.xyz. The wildcard will match any characters before the dot, and the | oper

IOA and Custom Detection

Question

When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?

Options

  • A*.baddomain.xyz|baddomain. xyz
  • B*baddomain. xyz|baddomain. xyz. *
  • CCustom IOA rules cannot be created for domains
  • Dbaddomain. xyz|baddomain. xyz

How the community answered

(37 responses)
  • A
    81% (30)
  • B
    5% (2)
  • C
    3% (1)
  • D
    11% (4)

Explanation

The syntax that would be best for detecting or preventing on all subdomains as well is *.baddomain.xyz|baddomain. xyz. This syntax will match any domain that ends with .baddomain.xyz or is exactly baddomain.xyz. The * wildcard will match any characters before the dot, and the | operator will match either side of the expression. This syntax can be used in a Custom IOC or a Custom IOA rule to detect or prevent network connections to malicious

Topics

#Custom IOA#regex syntax#domain detection#subdomain matching

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice