CCFA-200B · Question #55
When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?
The correct answer is A. *\.baddomain\.xyz|baddomain\. xyz. The syntax that would be best for detecting or preventing on all subdomains as well is .baddomain.xyz|baddomain. xyz. This syntax will match any domain that ends with .baddomain.xyz or is exactly baddomain.xyz. The wildcard will match any characters before the dot, and the | oper
Question
When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?
Options
- A*.baddomain.xyz|baddomain. xyz
- B*baddomain. xyz|baddomain. xyz. *
- CCustom IOA rules cannot be created for domains
- Dbaddomain. xyz|baddomain. xyz
How the community answered
(37 responses)- A81% (30)
- B5% (2)
- C3% (1)
- D11% (4)
Explanation
The syntax that would be best for detecting or preventing on all subdomains as well is *.baddomain.xyz|baddomain. xyz. This syntax will match any domain that ends with .baddomain.xyz or is exactly baddomain.xyz. The * wildcard will match any characters before the dot, and the | operator will match either side of the expression. This syntax can be used in a Custom IOC or a Custom IOA rule to detect or prevent network connections to malicious
Topics
Community Discussion
No community discussion yet for this question.