CrowdStrike Certified Falcon Responder (CCFR) — Question 46

Which option indicates a hash is allowlisted?

Answer options

• A. No Action
• B. Allow
• C. Ignore
• D. Always Block

Correct answer: B

Explanation

The correct answer is 'Allow' because it explicitly indicates that the hash is permitted. The other options either suggest no intervention ('No Action' and 'Ignore') or a prohibition ('Always Block'), which do not imply that the hash is allowlisted.