CrowdStrike Exam CCFR-201 Topic 1 Question 17 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 17
Topic #: 1

The function of Machine Learning Exclusions is to___________.

Astop all detections for a specific pattern ID

Bstop all sensor data collection for the matching path(s)

CStop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

Dstop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Show Suggested Answer

Suggested Answer: A

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2.You can set different actions for IOCs, such as Allow, No Action, or Always Block2.When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2.This action also generates a detection alert when the file is blocked2.

by Edison at Jul 04, 2024, 08:53 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Patti

8 hours ago

Option D seems like the most comprehensive answer. It covers stopping both detections and preventions, as well as stopping file uploads to the cloud.

upvoted 0 times

...

Vanda

10 days ago

That makes sense too. So, it's about excluding certain paths from the ML detections and preventing files from being uploaded to the cloud.

upvoted 0 times

...

Mattie

12 days ago

I believe it could also be to stop all sensor data collection for the matching path(s).

upvoted 0 times

...

Vanda

17 days ago

I think the function of Machine Learning Exclusions is to stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud.

upvoted 0 times

...