Free CCFA Crowdstrike CCFA Practice Test Question

Question 1 (Topic 1)

You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?

Select an option, then click Submit answer.

○ Contact support and request that they modify the Machine Learning settings to no longer include this detection
○ Using IOC Management, add the hash of the binary in question and set the action to "Allow"
○ Using IOC Management, add the hash of the binary in question and set the action to "Block, hide detection"
○ Using IOC Management, add the hash of the binary in question and set the action to "No Action"

Reference / correct answer:

Using IOC Management, add the hash of the binary in question and set the action to "Allow"

Most accepted answer: B. Using IOC Management, add the hash of the binary in question and set the action to "Allow"

Community votes: B=5, D=1

Selected Answer: B B is correct. upvoted 1 times

Selected Answer: B Option D, “Using IOC Management, add the hash of the binary in question and set the action to ‘No Action’,” would not be effective because it doesn’t actively prevent the false positives. By setting the action to “No Action,” the system would continue to detect the binary but simply not take any action on it. This means the false positives would still appear in your detection logs, potentially cluttering them and making it harder to identify genuine threats. On the other hand, setting the action to “Allow” (Option B) ensures that the binary is recognized as safe and prevents it from being flagged in the future, thus keeping your detection logs clean and focused on actual threats. upvoted 1 times

Selected Answer: B Option B is the correct because it won't generate detection while option D will keep generating detection but won't take any action. upvoted 1 times

@DarkieCopy Allow is present in IOC, I just looked. Allow means it will not log the detection, "No Action" means it will still collect data on occurences. upvoted 1 times

Selected Answer: D Got to disagree with everyone: I think D is correct answer. IOC management only allows "Detect only" and "No Action" among the possible actions, checked in console. Same happens in question #12. "Detect only" and "No Action" are the only possibilities in IOC management upvoted 1 times FerbOP 2 years, 6 months ago Check for Hash, for IP and Domain you have only Detect only and No Action upvoted 1 times ...

Question 2 (Topic 1)

When configuring a specific prevention policy, the admin can align the policy to two different types of groups, Host Groups and which other?

Select an option, then click Submit answer.

○ Custom IOA Rule Groups
○ Custom IOC Groups
○ Enterprise Groups
○ Operating System Groups

Question 3 (Topic 1)

How do you assign a policy to a specific group of hosts?

Select an option, then click Submit answer.

○ Create a group containing the desired hosts using "Static Assignment." Go to the Assigned Host Groups tab of the desired policy and dick "Add groups to policy." Select the desired Group(s).
○ Assign a tag to the desired hosts in Host Management. Create a group with an assignment rule based on that tag. Go to the Assignment tab of the desired policy and click "Add Groups to Policy." Select the desired Group(s).
○ Create a group containing the desired hosts using "Dynamic Assignment." Go to the Assigned Host Groups tab of the desired policy and select criteria such as OU, OS, Hostname pattern, etc.
○ On the Assignment tab of the desired policy, select "Static" assignment. From the next window, select the desired hosts (using fitters if needed) and click Add.

Free CCFA – Crowdstrike CCFA Practice Test Question