CrowdStrike Certified Falcon Administrator (CCFA) — Question 61

When would the No Action option be assigned to a hash in IOC Management?

Answer options

• A. When you want to save the indicator for later action, but do not want to block or allow it at this time
• B. Add the indicator to your allowlist and do not detect it
• C. There is no such option as No Action available in the Falcon console
• D. Add the indicator to your blocklist and show it as a detection

Correct answer: A

Explanation

The No Action option is appropriate when you wish to preserve the indicator for future evaluation without implementing any immediate block or allow behavior. Options B and D suggest active measures (allowlisting or blocklisting), which contradict the purpose of No Action. Option C is incorrect as No Action is indeed a valid option in the Falcon console.