3.4 Given a Use Case, Recommend a Runtime Sensor Policy Configuration CCCS Practice Questions (Page 3)

Questions 11–11

1. 11application · medium

   A healthcare organization is deploying CrowdStrike to servers that store electronic health records (EHR). The threat model includes ransomware and unauthorized data exfiltration. The servers run a legacy database that occasionally performs unusual but legitimate file operations. The security team wants to prevent ransomware while minimizing false positives that could interrupt patient care. Which policy configuration is most appropriate?

   • AEnable 'Moderate' prevention, disable file visibility to reduce overhead, and set response actions to 'Alert' for all events.
   • BEnable 'Moderate' prevention, enable visibility for file and registry activity, and set response actions to 'Block' for ransomware-related indicators.
   • CEnable 'Extra Aggressive' prevention, disable logging to improve performance, and set response actions to 'Block'.
   • DEnable 'Extra Aggressive' prevention with all detection settings enabled and response actions set to 'Block'.
   Reveal Solution Discussion Select an answer first