BlackFriday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CrowdStrike Exam CCFA-200 Topic 7 Question 28 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam
Question #: 28
Topic #: 7
[All CCFA-200 Questions]

When editing an existing IOA exclusion, what can NOT be edited?

Show Suggested Answer Hide Answer
Suggested Answer: A

When editing an existing IOA exclusion, the IOA name cannot be edited. An IOA (indicator of attack) exclusion allows you to define custom rules for excluding suspicious behavior from detection or prevention based on process execution, file write, network connection, or registry events. The IOA name is a predefined name that identifies the type of IOA behavior that you want to exclude, such as ''Suspicious Process Execution - Script Interpreter Executing File''. The IOA name cannot be changed when editing an existing IOA exclusion, as it is linked to a specific IOA rule in the Falcon platform.However, you can edit other parts of the IOA exclusion, such as the exclusion name, the hosts groups, and the filter criteria2.


by Gracia at Mar 18, 2024, 01:01 AM

Limited Time Offer

25%

Off

Get Premium CCFA-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Izetta
5 months ago
I think all parts of the exclusion can be changed except for the exclusion name
upvoted 0 times
...
Celestina
5 months ago
I believe the hosts groups can be edited, along with the IOA name
upvoted 0 times
...
Moira
5 months ago
But what about the hosts groups, can they be changed?
upvoted 0 times
...
Joni
5 months ago
I agree with Celestina, the exclusion name is fixed
upvoted 0 times
...
Celestina
5 months ago
I think the exclusion name can't be edited
upvoted 0 times
...
Roselle
5 months ago
That makes sense, since changing the exclusion itself could cause issues.
upvoted 0 times
...
Ty
5 months ago
I'm not sure, but I think the exclusion itself can't be edited.
upvoted 0 times
...
Dell
6 months ago
I agree, the IOA name and hosts groups can still be changed.
upvoted 0 times
...
Roselle
6 months ago
I think the exclusion name can't be edited.
upvoted 0 times
...

Save Cancel