CrowdStrike Certified Falcon Administrator (CCFA) — Question 31

You need to have the ability to monitor suspicious VBA macros. Which Sensor Visibility setting should be turned on within the Prevention policy settings?

Answer options

• A. Script-based Execution Monitoring
• B. Interpreter-Only
• C. Additional User Mode Data
• D. Engine (Full Visibility)

Correct answer: A

Explanation

The correct answer is A, as enabling Script-based Execution Monitoring allows for tracking and monitoring of suspicious VBA macros. The other options do not specifically address the monitoring of script execution, thus they are not suitable for the given requirement.