nerdexam
CrowdStrike

CCFR-201B · Question #50

When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The correct answer is B. The associated detection will be suppressed and the associated process would have been. By creating an exclusion you stop seeing detections that you don't want to see, and allow processes that would otherwise be prevented.

Exclusion Management

Question

When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

Options

  • AThe process specified is not sent to the Falcon Sandbox for analysis
  • BThe associated detection will be suppressed and the associated process would have been
  • CThe sensor will stop sending events from the process specified in the regex pattern
  • DThe associated IOA will still generate a detection but the associated process would have been

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    79% (15)
  • C
    5% (1)
  • D
    11% (2)

Explanation

By creating an exclusion you stop seeing detections that you don't want to see, and allow processes that would otherwise be prevented.

Topics

#IOA exclusion#detection suppression#process exclusion#prevention behavior

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCFR-201B Practice