6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing the IOC rules in a Falcon environment. They want to identify which rules are having the most impact on the security posture. Which metric should the analyst prioritize?

   • AThe number of endpoints each rule applies to.
   • BThe rule's action setting.
   • CThe number of detections each rule has generated.
   • DThe rule's expiration date.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A retail company has a custom IOC rule that detects a specific domain used by a point-of-sale malware family. The rule is set to 'Block' and has been running for 60 days with no detections. The security team wants to review the rule's effectiveness. What should they assess first?

   • AVerify that the rule is still enabled and not expired.
   • BCheck the rule's detection count in the Falcon console to see if it has matched any activity.
   • CCompare the rule's domain to current threat intelligence feeds.
   • DReview the rule's exclusion list for overly broad entries.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A manufacturing company uses a legacy application that writes a file named 'svchost.exe' in a non-standard directory as part of its normal operation. A new IOC rule for a known malware hash is triggering on this file. The analyst wants to keep the rule active for the rest of the environment. What is the most effective way to handle this?

   • AAdd the legacy application's directory to the IOC rule's exclusion list.
   • BSet the rule to expire in 24 hours to stop the alerts.
   • CChange the rule action to 'Detect' for all endpoints.
   • DDelete the rule and rely on machine learning detections.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A technology company has an IOC rule that detects a known malware hash. The rule is set to 'Block' and has been triggering on a legitimate application that shares the same hash. The security team wants to reduce false positives while maintaining the rule's detection capability. What is the most effective technique?

   • ADelete the rule and rely on other detection methods.
   • BChange the rule action to 'Detect' to reduce the impact.
   • CSet the rule to expire in 7 days to limit the noise.
   • DAdd the legitimate application's file path to the rule's exclusion list.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is deploying Falcon and wants to ensure that only high-confidence indicators trigger automated blocking. The security team is concerned about disrupting clinical workstations. They plan to use IOC rules for known malware hashes. Which IOC setting should the team configure to balance protection with operational continuity?

   • AUse 'Block' for rules with a short expiration and 'Detect' for longer-term rules.
   • BEnable 'Block' only on rules tagged with high-confidence metadata.
   • CConfigure rules with 'Block' for hashes from a trusted threat feed and 'Detect' for less-verified indicators.
   • DSet the default action for all IOC rules to 'Detect' only.
   Reveal Solution Discussion Select an answer first