Câu 6: CCFH-202B: CrowdStrike Certified Falcon Hunter
Falcon Machine Learning has prevented and quarantined a file being written to disk that has VSCode as a parent process. This file was compiled by the system owner. What should the next steps be?
Nội dung câu hỏi
Falcon Machine Learning has prevented and quarantined a file being written to disk that has VSCode as a parent process. This file was compiled by the system owner. What should the next steps be?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Detonate the file in a private sandbox, and write a Machine Learning exclusion if the file activity is expected — đáp án hiện tại
- B. Detonate the file in a private sandbox, and write an exclusion for the Indicator of Attack if the file activity is expected
- C. Search for the file hash in VirusTotal, and write a Sensor Visibility Exclusion
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.
Chưa có bình luận. Mở giao diện tương tác để bắt đầu thảo luận.