CCFA-200b practice question 15 of 25
What is the maximum number of patterns that can be added when creating a new exclusion?
Full set: 153 questionsDomain Endpoint Security
When configuring Machine Learning (ML) exclusions within a CrowdStrike Falcon prevention policy, a single exclusion rule can contain multiple patterns. The platform is designed to allow a user to add up to a maximum of 10 distinct patterns for each new exclusion created. These patterns can include file paths, file names, or directories that should be exempted from Machine Learning detections. This limit helps maintain policy efficiency and manageability while providing flexibility for administrators to group related exclusion patterns together.
B. 0: An exclusion must contain at least one pattern to be functional; zero patterns would make the rule meaningless.
C. 1: While you can create an exclusion with only one pattern, this is the minimum required, not the maximum allowed.
D. 5: This is an incorrect limit. The CrowdStrike Falcon platform allows for more than five patterns per exclusion rule.
1. CrowdStrike Falcon Documentation: Prevention Policy Settings Guide. In the section detailing "Machine Learning Exclusions," the user interface and backend limitations are specified. The guide states, "For each new exclusion, you can add up to 10 patterns." This is found under the configuration steps for creating ML exclusions. (Note: Specific page numbers vary by document version, but this detail is consistently located in the ML Exclusions section of the Prevention Policy documentation).
Keep practicing
Take the free CCFA-200b practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CCFA-200b practice questions
- Question 1After Network Containing a host, your Incident Response team states they are unable to re…
- Question 2Why would you assign hosts to a static group instead of a dynamic group?
- Question 3How can a API client secret be viewed after it has been created?
- Question 4What best describes what happens to detections in the console after clicking "Enable Dete…
- Question 5Which option best describes the general process Whereinstallation of the Falcon Sensor on…
- Question 6What is the purpose of a containment policy?
