Exclusion Type for Reducing False Positive Alerts: c:\myxyzapp\myxyzwinapp.exe
Question
There are multiple false positive alerts generating in a company XYZ.
A security operations analyst working for XYZ needs to exclude an executable file to reduce alerts - c:\myxyzapp\myxyzwinapp.exe, which exclusion type must they use?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: C
File will exclude only this specific file whereas extension would exclude all files with the extensions and folder would exclude all files in a folder.
Registry exclusion doesn't happen.
Reference:
The correct exclusion type that the security operations analyst should use to exclude the executable file c:\myxyzapp\myxyzwinapp.exe to reduce false positive alerts is C. File.
Excluding a file means that the security operations analyst can instruct the security monitoring tool to ignore any activity related to the specified file. This can be useful when there is a known trusted file that generates frequent alerts or when a file is mistakenly identified as malicious.
Excluding based on extension, on the other hand, would instruct the security monitoring tool to ignore any activity related to all files with the specified extension, which may not be desirable if other files with the same extension are potential security risks.
Excluding based on folder would instruct the security monitoring tool to ignore any activity related to all files within the specified folder, which may not be desirable if there are other files within the folder that require monitoring.
Excluding based on registry would instruct the security monitoring tool to ignore any activity related to registry keys and values specified, which may not be relevant to the file exclusion.
Therefore, in this scenario, the most appropriate exclusion type would be C. File, as it allows the security operations analyst to specify the exact file that needs to be excluded from monitoring to reduce false positive alerts.
