Free Preparation Discussions
MENU
CrowdStrike Exam CCFA-200 Topic 9 Question 34 Discussion
Topic #: 9
You need to have the ability to monitor suspicious VBA macros. Which Sensor Visibility setting should be turned on within the Prevention policy settings?
Turn on the Script-Based Execution Monitoring prevention policy setting to enable the 'Falcon sensor to monitor the contents of scripts and shells that are popular mechanisms for executing malicious code on hosts. This setting does not kill or block scripts.'
Scripting languages:
Excel 4.0 macros
JScript
VBA Macros
VBScript
The Sensor Visibility setting that should be turned on within the Prevention policy settings to monitor suspicious VBA macros is Script-based Execution Monitoring. Script-based Execution Monitoring is a feature that enables the Falcon sensor to monitor and prevent malicious script execution on Windows systems. The feature uses machine learning and behavioral analysis to detect suspicious scripts or commands executed by various script interpreters, such as PowerShell, WScript, CScript, or Bash. VBA (Visual Basic for Applications) is a scripting language that can be embedded in Microsoft Office documents, such as Word or Excel. VBA macros can be used to automate tasks or perform actions within the documents, but they can also be abused by attackers to deliver malware or execute malicious code. Script-based Execution Monitoring can help detect and prevent such attacks by monitoring the contents of VBA macros for execution of malicious content.
Tuyet
5 months agoRebecka
4 months agoSage
4 months agoBeckie
4 months agoTawna
5 months agoIzetta
4 months agoEvangelina
4 months agoKimi
4 months agoLeatha
5 months agoSage
5 months agoMichel
5 months agoAlana
4 months agoGianna
4 months agoMargarita
4 months agoEleonore
4 months agoRosendo
4 months agoBerry
5 months agoEladia
5 months agoBethanie
5 months agoFrank
5 months agoNu
5 months agoWilburn
5 months agoShawnna
5 months ago