An organization is implementing prevention policies for its Falcon-managed endpoints. Which of the following prevention policy configurations would best protect against ransomware attacks while maintaining usability?

This configuration provides the most robust, multi-layered defense against ransomware. Enabling "Aggressive" ransomware protection utilizes the most sensitive machine learning models to detect and block ransomware-like behaviors. Enabling "Write Deny" for critical folders is a crucial hardening step that directly prevents unauthorized processes from encrypting user data in common locations. Finally, enabling script blocking helps to neutralize a primary vector for ransomware delivery and execution, such as malicious PowerShell or VBScript files. Together, these three settings address the attack chain at multiple points, offering the best protection while allowing for tuning (e.g., exclusions) to maintain usability.

A. Disabling "Write Deny" is a critical omission, as it leaves the most valuable user data vulnerable to direct encryption by a ransomware process.
C. Disabling "Aggressive" protection significantly weakens the primary machine learning and behavioral analysis engine responsible for identifying and stopping novel ransomware threats.
D. Disabling script blocking leaves a common and highly effective attack vector open, as many ransomware campaigns rely on malicious scripts for initial execution and propagation.

1. CrowdStrike Falcon® Platform Documentation

Prevention Policy Settings Guide.

Section: Machine Learning > Ransomware: Details the "Aggressive" setting

which is described as having the highest level of detection and prevention for ransomware-like file activity

recommended for systems with critical data.

Section: Suspicious Processes > Windows: Describes settings that prevent suspicious processes from performing malicious actions

including controls analogous to "Write Deny" that protect critical system and user data locations from unauthorized modification.

Section: Execution Blocking > Script-Based Execution Monitoring: Explains that enabling this feature allows the sensor to monitor and block malicious scripts (e.g.

PowerShell

VBScript

Office Macros)

which are common ransomware vectors.

2. SANS Institute

Endpoint Protection and Response: A SANS Survey (2021).

Page 12

"Key Endpoint Protection Capabilities": The survey highlights the importance of a multi-layered defense on the endpoint. It emphasizes the combination of machine learning-based behavioral detection

exploit blocking

and script control as critical for stopping modern attacks like ransomware

aligning with the strategy in the correct answer.

3. MITRE ATT&CK® Evaluations: Turla (2022)

CrowdStrike Results.

Detection Details for T1059 (Command and Scripting Interpreter): The evaluation results demonstrate Falcon's ability to detect and prevent malicious script execution. This underscores the importance of enabling script blocking as part of a comprehensive prevention policy to stop techniques frequently used in the initial stages of a ransomware attack.