Câu 29: CCFA-200B: CrowdStrike Certified Falcon Administrator

Your organization wants to monitor the use of remote access software that is currently authorized. The executable is called remote.exe. How would you trigger a detection for review of any process named remote.exe?

1. A. Write an IOA rule to monitor process creation of .*\\remote\.exe — đáp án hiện tại
2. B. Create an exclusion for remote.exe and set a workflow to email you every time the exclusion is used
3. C. Write a scheduled search looking for ProcessRollup2 events for remote.exe
4. D. Assign an aggressive detection level machine-learning prevention policy to the applicable hosts