A software company has a custom IOC rule that blocks a specific malicious file hash. The rule is set to 'Block' and applies to all endpoints. Recently, a developer's build process creates a file with the same hash due to a collision. The developer is blocked and cannot work. The security team wants to allow the developer to proceed while keeping the rule active for the rest of the company. What should they do?

Delete the rule and recreate it with a different hash.

Change the rule action to 'Detect' for the developer's endpoint group.

Add the developer's build path to the rule's exclusion list.

Set the rule to expire immediately and rely on other detections.

A government agency has several IOC rules with different actions. The security team wants to understand how these rules affect the overall security posture. They notice that a rule with a 'Block' action has not triggered in 90 days. What is the most appropriate conclusion?

The rule is working correctly because no matching activity has occurred.

The rule's expiration should be shortened to reduce overhead.

The rule should be changed to 'Detect' to gather more data.

The rule is ineffective and should be deleted.

Which Falcon IOC configuration technique is most effective at reducing false positives caused by a legitimate application that contacts a known domain?

Adding the domain to an exclusion list

Changing the action to Detection

Increasing the severity of the IOC rule

A security administrator is configuring IOC rules for a new Falcon deployment. The organization wants to ensure that IOC rules do not disrupt critical business applications. Which IOC setting should the administrator configure to achieve this?

Set the default action for all IOC rules to 'Block'.

Set a short expiration for all IOC rules.

Apply all IOC rules to a single endpoint group.

Use 'Detect' for rules that apply to critical business applications.

CrowdStrikeCertified Falcon Administrator (CCFA)

Domain 6Objective 3

6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 3)

Part of the Rules Configuration domain, which makes up ~13% of our current practice bank.

21questions here

5free pages

4concepts

Questions 11–15

11application · medium
A software company has a custom IOC rule that blocks a specific malicious file hash. The rule is set to 'Block' and applies to all endpoints. Recently, a developer's build process creates a file with the same hash due to a collision. The developer is blocked and cannot work. The security team wants to allow the developer to proceed while keeping the rule active for the rest of the company. What should they do?
Select an answer first
12application · medium
A government agency has several IOC rules with different actions. The security team wants to understand how these rules affect the overall security posture. They notice that a rule with a 'Block' action has not triggered in 90 days. What is the most appropriate conclusion?
Select an answer first
13foundation · easy
Which Falcon IOC configuration technique is most effective at reducing false positives caused by a legitimate application that contacts a known domain?
Select an answer first
14application · medium
A security administrator is configuring IOC rules for a new Falcon deployment. The organization wants to ensure that IOC rules do not disrupt critical business applications. Which IOC setting should the administrator configure to achieve this?
Select an answer first
15foundation · easy
Which Falcon IOC setting is used to restrict a rule so it only applies to endpoints running a specific operating system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFA” is a trademark of its owner, used for identification only.

6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 3)

Questions 11–15

A government agency has several IOC rules with different actions. The security team wants to understand how these rules affect the overall security posture. They notice that a rule with a 'Block' action has not triggered in 90 days. What is the most appropriate conclusion?

Which Falcon IOC configuration technique is most effective at reducing false positives caused by a legitimate application that contacts a known domain?

A security administrator is configuring IOC rules for a new Falcon deployment. The organization wants to ensure that IOC rules do not disrupt critical business applications. Which IOC setting should the administrator configure to achieve this?

Which Falcon IOC setting is used to restrict a rule so it only applies to endpoints running a specific operating system?

Keep studying — Rules Configuration