Exam CCFA topic 1 question 2 discussion

Option D, “Using IOC Management, add the hash of the binary in question and set the action to ‘No Action’,” would not be effective because it doesn’t actively prevent the false positives. By setting the action to “No Action,” the system would continue to detect the binary but simply not take any action on it. This means the false positives would still appear in your detection logs, potentially cluttering them and making it harder to identify genuine threats. On the other hand, setting the action to “Allow” (Option B) ensures that the binary is recognized as safe and prevents it from being flagged in the future, thus keeping your detection logs clean and focused on actual threats.

Option B is the correct because it won't generate detection while option D will keep generating detection but won't take any action.

@DarkieCopy Allow is present in IOC, I just looked. Allow means it will not log the detection, "No Action" means it will still collect data on occurences.

Got to disagree with everyone: I think D is correct answer. IOC management only allows "Detect only" and "No Action" among the possible actions, checked in console. Same happens in question #12. "Detect only" and "No Action" are the only possibilities in IOC management

B is correct

B - Allow,do not detect

I think B is correct