CrowdStrike Exam CCFA-200 Topic 10 Question 18 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam

Question #: 18
Topic #: 10

Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?

A.*badguydomain.com.*

B\Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill

Cbadguydomain\.com.*

DCustom IOA rules cannot be created for domains

Show Suggested Answer

Suggested Answer: A

by Serina at Apr 01, 2023, 10:12 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

3 days ago

I think option B is the correct answer. It looks like a comprehensive rule that can kill any process trying to access the bad domain.

upvoted 0 times

...

13 days ago

Hmm, that makes sense too. Let's see what others think before we finalize our answer.

upvoted 0 times

...

13 days ago

I disagree, I believe the correct answer is A) .*badguydomain.com.* because it covers any process attempting to access the domain.

upvoted 0 times

...

16 days ago

I think the answer is B) \Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill.

upvoted 0 times

...