Exam CCFA topic 1 question 3 discussion

The correct answer is D. Here is the explanation taken from the official CrowdStrike documentation: "On the Containment Policy page, you can allow IP addresses over which your hosts will always be allowed to communicate, even if a host is contained."

Option C is correct: While defining allowed IP addresses over which your hosts will communicate when contained is important, it is typically part of a broader network configuration or security policy rather than the primary purpose of a containment policy. A containment policy specifically focuses on the conditions or triggers that necessitate placing a machine into network containment, such as detecting a critical threat. This helps ensure that immediate action is taken to isolate the affected machine and prevent the spread of potential threats.

Option C is correct: While defining allowed IP addresses over which your hosts will communicate when contained is important, it is typically part of a broader network configuration or security policy rather than the primary purpose of a containment policy. A containment policy specifically focuses on the conditions or triggers that necessitate placing a machine into network containment, such as detecting a critical threat. This helps ensure that immediate action is taken to isolate the affected machine and prevent the spread of potential threats.

D is correct, can be seen in UI under Host Setup and Management > Containment Policy > Add allowlist entry

El D es el correcto

D is correct

Yup, its D

D, Network traffic allowlist

Checked the portal and it is D

D is correct, In the Containment Policy page have the title "Network traffic allowlist" and it only allows to add IPs or CIDR networks to exclude in the moment of the isolation of any host, because it is a global policy, not allowing make distinctions between machines.

Verified with Falcon's documentation - D is correct.

Tested on Falcon. Containment policy is only used to allow communication to specific IPs or IP ranges when a host is contained.