exam questions

Exam CCFA All Questions

View all questions & answers for the CCFA exam

Exam CCFA topic 1 question 203 discussion

Actual exam question from CrowdStrike's CCFA
Question #: 203
Topic #: 1
[All CCFA Questions]

Which ML exclusion pattern would be the most accurate for all .exe binaries in "C:\Program Files\Software\", including any subfolders of Software?

  • A. Program Files\Software\*.exe
  • B. **\*.exe
  • C. Program Files\Software\**.exe
  • D. Program Files\Software\**\*..exe
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
RIchardMatos
3 months, 2 weeks ago
Selected Answer: C
C is the correct. D is wrong, thats why: D: (**\*.exe) This pattern is more rigid and likely to fail. The **\ part means "match zero or more directories, which must be followed by a path separator (\)." For a subfolder like C:\Program Files\Software\Utils\app.exe: This works. The ** matches Utils, and the \ matches the separator. For the top-level folder like C:\Program Files\Software\main.exe: This will likely FAIL. The ** matches zero directories, but then there is no backslash (\) between the Software folder and the main.exe filename.
upvoted 1 times
...
afc9292
4 months, 1 week ago
Selected Answer: D
C is not correct- Tested with console, doesn't work for subdirectories. Mus be D but thers is an error with the two dots before exe, must be Program Files\Software\**\*.exe
upvoted 1 times
...
CiscoNoahexamtopic
5 months, 3 weeks ago
Selected Answer: C
** (globstar) excludes all the current directory’s files and nested subdirectories.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...