CrowdStrike Certified Falcon Responder (CCFR) — Question 43

What happens when a hash is allowlisted?

Answer options

• A. Execution is prevented, but detection alerts are suppressed
• B. Execution is allowed on all hosts, including all other Falcon customers
• C. The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
• D. Execution is allowed on all hosts that fall under the organization's CID

Correct answer: D

Explanation

The correct answer is D because allowlisting a hash means that it can run on all hosts within the specific organization's control. Option A is incorrect because allowlisting does not prevent execution; option B is wrong as it implies unrestricted execution across all Falcon customers; option C is misleading since allowlisting does not require prior approval from specialists.