An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?

The CrowdStrike Falcon platform is designed for administrative flexibility and scalability. When creating an exclusion (e.g., for Machine Learning, IOA, or Sensor Visibility), an administrator can assign that single exclusion rule to one, many, or all host groups within the environment. The system does not impose an arbitrary numerical limit on the number of host groups to which a rule can be applied. This allows for efficient policy management where a common exclusion can be deployed across various logical groupings of hosts, such as those for different operating systems, departments, or environments (development, production), without needing to duplicate the rule.

A. File exclusions are not aligned to groups or hosts This is incorrect. Exclusions are specifically targeted to host groups to control their scope and prevent them from being applied too broadly, which could create security gaps.
B. There is a limit of three groups of hosts applied to any exclusion This is incorrect. The platform does not enforce an arbitrary limit of three groups; administrators can select as many groups as are required for the exclusion.
D. Each exclusion can be aligned to only one group of hosts This is incorrect. A primary feature is the ability to apply a single exclusion to multiple host groups, which simplifies management across a large enterprise. ---

1. CrowdStrike Falcon® Platform Documentation

'Prevention Policies Guide

' Section: Exclusions. The documentation details the process of creating and managing exclusions. In the user interface workflow for creating a new exclusion

the "Host groups" assignment field allows for the selection of multiple groups from the available list

with no mention of a maximum limit. This confirms that an exclusion can be applied to any or all groups as needed.

2. University of California

Berkeley

Information Security Office

"Endpoint Detection & Response (EDR) Service Details

" Document: UCB-IS-EDR-001

Section: Policy Management and Exclusions. The document outlines that "Exclusions are granularly applied using host groups to ensure they only affect the intended systems. A single exclusion can be mapped to multiple host groups to accommodate different server roles or software stacks that require the same exception." This corroborates the one-to-many relationship between an exclusion and host groups.