exam questions

Exam CCFA All Questions

View all questions & answers for the CCFA exam

Exam CCFA topic 1 question 128 discussion

Actual exam question from CrowdStrike's CCFA
Question #: 128
Topic #: 1
[All CCFA Questions]

When creating a custom IOA for a specific domain, which syntax would be best for detecting or preventing on all subdomains as well?

  • A. .*\.baddomain\.xyz|baddomain\.xyz
  • B. **baddomain\.xyz|baddomain\.xyz**
  • C. .*baddomain\.xyz|baddomain\.xyz.*
  • D. Custom IOA rules cannot be created for domains
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Eduman
2 weeks, 3 days ago
Selected Answer: C
C is better with regards to scripting
upvoted 1 times
...
kitkat007
3 months, 1 week ago
Selected Answer: A
A. .*.baddomain.xyz|baddomain.xyz This syntax ensures that all subdomains of baddomain.xyz (e.g., sub.baddomain.xyz) as well as the domain itself (baddomain.xyz) are covered. The .*\. part before the domain captures any subdomain, while baddomain\.xyz matches the domain itself. The pipe (|) acts as an OR operator
upvoted 1 times
...
p3n3tr4t0r
5 months, 2 weeks ago
Selected Answer: C
C is correct. Checked on training
upvoted 1 times
...
Muffen
8 months, 2 weeks ago
Selected Answer: A
Disagree with Brian. C is not specific enough and would match things like notabaddomain.xyz and baddomain.xyz.com A is the best solution for specifically looking for subdomains of baddomain.xyz or just the domain itself which is what the question asked for.
upvoted 3 times
...
Brian9296
1 year, 1 month ago
Selected Answer: C
Tested in UI
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago