6.3 Assess IOC Settings Required for Customized Security Posturing and to Manage False Positives CCFA Practice Questions (Page 5)

Questions 21–21

1. 21expert · hard

   A large organization has a custom IOC rule for a known APT group's infrastructure. The rule is set to 'Block' and applies to all endpoints. The security team discovers that the rule is blocking a legitimate cloud storage service that shares an IP address with the APT infrastructure. The service is used by the marketing department for daily operations. The team needs to restore service quickly while maintaining the rule's protection for the rest of the organization. What is the best approach?

   • AChange the rule action to 'Detect' for the marketing department's endpoint group.
   • BSet the rule to expire in 1 hour to allow marketing to work.
   • CDelete the rule and recreate it with a different indicator.
   • DAdd the cloud storage service's domain or IP to the rule's exclusion list.
   Reveal Solution Discussion Select an answer first