Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CrowdStrike CCFA-200b Exam - Topic 7 Question 13 Discussion

Which of the following applies to Custom Blocking Prevention Policy settings?
A) Hashes must be entered on the Prevention Hashes page before they can be blocked via this policy
B) Blocklisting applies to hashes, IP addresses, and domains
C) Executions blocked via hash blocklist may have partially executed prior to hash calculation process remediation may be necessary
D) You can only blocklist hashes via the API

CrowdStrike CCFA-200b Exam - Topic 7 Question 13 Discussion

Actual exam question for CrowdStrike's CCFA-200b exam
Question #: 13
Topic #: 7
[All CCFA-200b Questions]

Which of the following applies to Custom Blocking Prevention Policy settings?

Show Suggested Answer Hide Answer
Suggested Answer: A

Falcon allows you to upload hashes from your own black or white lists. To enabled this navigate to the Configuration App, Prevention hashes window, and click on ''Upload Hashes'' in the upper right-hand corner. Note that you can also automate the task of importing hashes with the CrowdStrike Falcon API.

https://www.crowdstrike.com/blog/tech-center/how-to-prevent-malware-with-custom-blacklisting/


by Marguerita at Jun 27, 2026, 07:12 PM

Limited Time Offer

25%

Off

Get Premium CCFA-200b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Elena
2 days ago
C makes sense. Some executions might slip through.
upvoted 0 times
...
Denna
7 days ago
I agree, but B sounds right too. Blocklisting is broader.
upvoted 0 times
...
Denny
12 days ago
I think A is correct. Hashes need to be set first.
upvoted 0 times
...
Vanda
17 days ago
B covers more ground. IPs and domains are crucial.
upvoted 0 times
...
Leontine
23 days ago
A is definitely a must. Without hashes, no blocking.
upvoted 0 times
...
Genevieve
28 days ago
D seems too limiting. We need more options for blocklisting.
upvoted 0 times
...
Cherelle
1 month ago
C is interesting. It highlights execution issues.
upvoted 0 times
...
Brittney
1 month ago
I agree, but B sounds valid too. Blocklisting is broader.
upvoted 0 times
...
Danica
1 month ago
I think A is correct. Hashes need to be set first.
upvoted 0 times
...
Joseph
2 months ago
I think A) and C) are the most important points here.
upvoted 0 times
...
Rolland
2 months ago
Wait, C) means it could still run before being blocked? That's wild!
upvoted 0 times
...
Apolonia
2 months ago
B) is correct, blocklisting covers all those areas.
upvoted 0 times
...
Azzie
2 months ago
I disagree with D, you can blocklist hashes in the UI too!
upvoted 0 times
...
Eulah
2 months ago
A) is definitely true, hashes need to be set first.
upvoted 0 times
...
Colette
2 months ago
I’m not confident about D; I feel like we can blocklist hashes through the interface as well, not just the API.
upvoted 0 times
...
Kaycee
3 months ago
C seems plausible too, especially the part about executions being blocked after some execution has already happened. I think I saw something like that in our study materials.
upvoted 0 times
...
Niesha
3 months ago
I remember practicing a question about blocklisting, and I feel like B is correct since it mentions multiple types like hashes and IPs.
upvoted 0 times
...
Carlee
3 months ago
I think option A sounds familiar, but I'm not entirely sure if hashes need to be entered first for the policy to work.
upvoted 0 times
...

Save Cancel