6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has an IOC rule that detects a known malicious domain. The rule is set to 'Block' and is generating alerts for a legitimate website that shares the same domain suffix. The security team wants to reduce false positives while keeping the rule active. What is the best way to refine the rule?

   • ADelete the rule and rely on other detection methods.
   • BChange the rule action to 'Detect' to reduce the impact.
   • CChange the rule to match the exact full domain instead of the suffix.
   • DSet the rule to expire in 7 days to limit the noise.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In CrowdStrike Falcon, which IOC setting determines whether an indicator triggers an alert, is added to a detection, or is ignored entirely?

   • AThe expiration date of the IOC
   • BThe action assigned to the IOC rule
   • CThe platform of the endpoint
   • DThe severity level of the IOC
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A multinational corporation has multiple IOC rules with different actions and scopes. The security team is reviewing the overall impact of these rules. They notice that a rule with a 'Block' action has a high false positive rate, causing operational disruptions in a specific region. The team needs to reduce the impact without losing the rule's protection. What is the best approach?

   • AAdd the specific file paths or processes causing the false positives to the rule's exclusion list.
   • BDelete the rule and recreate it with a different action.
   • CSet the rule to expire in 24 hours to stop the disruptions.
   • DChange the rule action to 'Detect' for the affected region's endpoint group.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A media company has an IOC rule that detects a known phishing domain. The rule is set to 'Detect' and has been generating a moderate number of alerts. The security team wants to understand the rule's impact on the security posture. What is the most important factor to consider?

   • AThe number of false positives generated by the rule.
   • BThe rule's action setting.
   • CThe number of endpoints the rule applies to.
   • DThe rule's expiration date.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When assessing the impact of an IOC rule, which Falcon feature provides visibility into how many endpoints have matched the rule over a given time period?

   • AThe rule's platform setting
   • BThe rule's severity level
   • CThe rule's match count in the IOC management view
   • DThe rule's expiration date
   Reveal Solution Discussion Select an answer first