Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CrowdStrike CCFA-200b Exam - Topic 7 Question 13 Discussion

Which of the following applies to Custom Blocking Prevention Policy settings?
A) Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
B) Blocklisting applies to hashes, IP addresses, and domains
C) Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
D) You can only blocklist hashes via the API

CrowdStrike CCFA-200b Exam - Topic 7 Question 13 Discussion

Actual exam question for CrowdStrike's CCFA-200b exam
Question #: 13
Topic #: 7
[All CCFA-200b Questions]

Which of the following applies to Custom Blocking Prevention Policy settings?

Show Suggested Answer Hide Answer
Suggested Answer: A

Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on ''Upload Hashes'' in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon API.

https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom-blacklisting/


by Marguerita at Jun 27, 2026, 07:12 PM

Limited Time Offer

25%

Off

Get Premium CCFA-200b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Joseph
3 days ago
I think A) and C) are the most important points here.
upvoted 0 times
...
Rolland
8 days ago
Wait, C) means it could still run before being blocked? That's wild!
upvoted 0 times
...
Apolonia
13 days ago
B) is correct, blocklisting covers all those areas.
upvoted 0 times
...
Azzie
18 days ago
I disagree with D, you can blocklist hashes in the UI too!
upvoted 0 times
...
Eulah
24 days ago
A) is definitely true, hashes need to be set first.
upvoted 0 times
...
Colette
29 days ago
I’m not confident about D; I feel like we can blocklist hashes through the interface as well, not just the API.
upvoted 0 times
...
Kaycee
1 month ago
C seems plausible too, especially the part about executions being blocked after some execution has already happened. I think I saw something like that in our study materials.
upvoted 0 times
...
Niesha
1 month ago
I remember practicing a question about blocklisting, and I feel like B is correct since it mentions multiple types like hashes and IPs.
upvoted 0 times
...
Carlee
1 month ago
I think option A sounds familiar, but I'm not entirely sure if hashes need to be entered first for the policy to work.
upvoted 0 times
...

Save Cancel