6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational corporation has a custom IOC rule for a known ransomware hash. The rule is set to 'Block' and applies to all endpoints. The security team discovers that the rule is blocking a legitimate software update that shares the same hash due to a vendor error. The update is critical for compliance in the EU region. The team needs to restore the update while maintaining the rule's protection for the rest of the organization. What is the best approach?

   • AChange the rule action to 'Detect' for the EU region's endpoint group.
   • BAdd the software update's file path to the rule's exclusion list.
   • CDelete the rule and recreate it with a different hash from the vendor.
   • DSet the rule to expire in 1 hour to allow the update to proceed.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which Falcon IOC rule setting allows an administrator to define the specific value that will be matched, such as a domain name or IP address?

   • AType
   • BExpiration
   • CSeverity
   • DAction
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A university's security team created an IOC rule for a known exploit kit's command-and-control domain. The rule is generating a high volume of alerts because the domain is also used by a popular ad network. The team wants to reduce noise without losing the ability to detect the exploit kit. What should they do?

   • ASet the rule to expire in 7 days to limit the noise window.
   • BAdd a condition to the rule that requires a specific process name associated with the exploit kit.
   • CDelete the rule and rely on behavioral detection for the exploit kit.
   • DChange the rule action to 'Detect' to reduce the alert severity.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise has a custom IOC rule for a known ransomware hash. The rule is set to 'Block' and applies to all endpoints. After deployment, the security team receives reports that the rule is blocking a legitimate internal tool that shares the same hash due to a vendor packaging error. The tool is critical for finance operations. The team needs to restore operations quickly while maintaining the rule's protection for the rest of the environment. What is the best approach?

   • ASet the rule to expire in 1 hour to allow finance to work.
   • BChange the rule action to 'Detect' for the finance department's endpoint group.
   • CAdd the finance tool's file path to the rule's exclusion list.
   • DDelete the rule and recreate it with a different hash from the vendor.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An IOC rule for a file hash is generating false positives because the hash belongs to a commonly used internal tool. Which Falcon feature should be used to stop alerts for this specific hash while keeping the rule active for other indicators?

   • AIncrease the rule's severity
   • BChange the rule action to Alert
   • CDelete the IOC rule entirely
   • DCreate an exclusion for the file hash
   Reveal Solution Discussion Select an answer first