MENU
An application has been identified by the LSASS Credentials Harvesting Module.
What is the recommended approach to excluding the application?
Suggested Answer: C
Get Premium EPM-DEF Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
38 comments · newest first
AN
Annalee
11 months ago
D seems a bit overkill for just excluding an app.
LA
Larae
11 months ago
Wait, can you really exclude it like that? Sounds risky.
MA
Malcom
11 months ago
Definitely C, that's how you handle LSASS!
ED
Edna
11 months ago
I think B makes more sense for exclusions.
LA
Layla
12 months ago
Option A is the way to go!
FE
Felix
12 months ago
I recall something about advanced policies being useful in these scenarios, so maybe D is the correct choice after all.
MA
Marjory
1 year ago
I’m a bit confused about the difference between A and B. They both seem like they could work for excluding applications.
LE
Lelia
1 year ago
I remember practicing a question similar to this, and I feel like excluding the application directly in the LSASS module could be the way to go. Maybe it's C?
WH
Whitney
1 year ago
I think the right answer might be A, but I'm not entirely sure if that's the best way to handle exclusions.
ES
Estrella
1 year ago
I'm a little confused by this question. Is there a specific reason why we would want to exclude the application? I feel like I'm missing some context here. I'll need to re-read the question and the options carefully.
TA
Tammy
1 year ago
Okay, I've got it! The answer is to add the application to an Advanced Policy or Application Group with an Elevate policy action. That way, it will be properly excluded without any issues.
JO
Jolanda
1 year ago
Hmm, I'm a bit unsure about this one. I'm not sure if adding it to the Files to be Ignored Always is the right approach, or if I should try to exclude it within the LSASS Credentials Harvesting module itself. I'll have to think this through carefully.
VA
Van
1 year ago
I think the recommended approach is to add the application to the Threat Protection Exclusions in Agent Configurations. That seems like the most straightforward way to exclude it.
AL
Aliza
1 year ago
I'm a bit confused on the difference between PESSIMISTIC_READ and READ. Are they really the same thing? I'll need to double-check the documentation on that.
AN
Annamae
1 year ago
I'm just gonna solve this problem by turning the computer off and on again. It's the IT version of duct tape and bubble gum!
CH
Chau
1 year ago
D) Add the application to an Advanced Policy or Application Group with an Elevate policy action.
RE
Reynalda
1 year ago
C) Exclude the application within the LSASS Credentials Harvesting module.
EL
Ellsworth
1 year ago
B) Add the application to the Files to be Ignored Always in Agent Configurations.
PA
Paul
1 year ago
A) In Agent Configurations, add the application to the Threat Protection Exclusions.
BO
Bonita
1 year ago
D) Add the application to an Advanced Policy or Application Group with an Elevate policy action? Now we're talking! That's like putting a superhero cape on the app.
JU
Juan
1 year ago
C) Exclude the application within the LSASS Credentials Harvesting module.
BO
Bobbye
1 year ago
B) Add the application to the Files to be Ignored Always in Agent Configurations.
CR
Cristen
1 year ago
A) In Agent Configurations, add the application to the Threat Protection Exclusions
IL
Iluminada
1 year ago
C) Exclude the application within the LSASS Credentials Harvesting module? Hmm, sounds like a lot of work. I'd rather just unplug the computer and call it a day.
DI
Dick
1 year ago
C) Exclude the application within the LSASS Credentials Harvesting module.
SC
Scot
1 year ago
B) Add the application to the Files to be Ignored Always in Agent Configurations.
MA
Ma
1 year ago
A) In Agent Configurations, add the application to the Threat Protection Exclusions.
JE
Jerrod
2 years ago
B) Add the application to the Files to be Ignored Always in Agent Configurations? Nah, that's not gonna work. Might as well just throw the whole computer out the window!
RO
Rory
1 year ago
D) Add the application to an Advanced Policy or Application Group with an Elevate policy action.
JA
Jaclyn
1 year ago
B) Add the application to the Files to be Ignored Always in Agent Configurations? Nah, that's not gonna work.
GA
Galen
1 year ago
C) Exclude the application within the LSASS Credentials Harvesting module.
RO
Rolland
1 year ago
A) In Agent Configurations, add the application to the Threat Protection Exclusions.
AN
Antonette
2 years ago
A) In Agent Configurations, add the application to the Threat Protection Exclusions? That's the way to go! Easy peasy lemon squeezy.
VI
Virgie
1 year ago
Great, it's a simple solution to prevent the application from being affected.
CI
Ciara
1 year ago
Yes, that's the recommended approach. It will exclude the application from being targeted.
DO
Dorian
2 years ago
But wouldn't adding the application to an Advanced Policy or Application Group with an Elevate policy action be a better option?
HO
Hoa
2 years ago
I disagree, I believe we should add the application to the Threat Protection Exclusions in Agent Configurations.
DO
Dorian
2 years ago
I think the recommended approach is to exclude the application in the LSASS Credentials Harvesting module.