Câu 24: CCFH-202B: CrowdStrike Certified Falcon Hunter

Falcon Machine Learning has prevented and quarantined a file being written to disk that has VSCode as a parent process. This file was compiled by the system owner. What should the next steps be?

1. A. Detonate the file in a private sandbox, and write a Machine Learning exclusion if the file activity is expected — đáp án hiện tại
2. B. Detonate the file in a private or public sandbox, and write a Machine Learning exclusion
3. C. Detonate the file in a private sandbox, and write an exclusion for the Indicator of Attack if the file activity is expected