CrowdStrike Exam CCFA-200 Topic 10 Question 18 Discussion

Actual exam question for CrowdStrike's CCFA-200 exam

Question #: 18
Topic #: 10

Which of the following is an effective Custom IOA rule pattern to kill any process attempting to access www.badguydomain.com?

A.*badguydomain.com.*

B\Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill

Cbadguydomain\.com.*

DCustom IOA rules cannot be created for domains

Show Suggested Answer

Suggested Answer: A

by Serina at Apr 01, 2023, 10:12 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

14 days ago

Option B is the way to go. I'm just imagining some poor hacker's process getting instantly vaporized. Poof!

upvoted 0 times

...

15 days ago

I'm going with B. Seems like the best way to surgically target the bad domain without causing any collateral damage.

upvoted 0 times

...

1 months ago

Haha, D is just plain wrong. Of course we can create custom IOA rules for domains, that's like the whole point!

upvoted 0 times

2 days ago

A) .*badguydomain.com.*

upvoted 0 times

...

1 months ago

Option A seems a bit too broad. I'd be worried it might catch legitimate traffic as well. C is a bit too specific, no?

upvoted 0 times

...

2 months ago

I think the answer is B) \Device\HarddiskVolume2\*.exe -SingleArgument www.badguydomain.com /kill.

upvoted 0 times

...