Any countries or regions included in the _ will trigger a geolocation detection.

Falcon Identity Protection supportsgeolocation-based detectionsto identify potentially risky authentication activity originating from unexpected or prohibited locations. According to the CCIS curriculum, any countries or regions added to theBlocklistwill automatically trigger a geolocation-based detection when authentication traffic is observed from those locations.

The Blocklist is designed to explicitly definedisallowed geographic regions. When an authentication attempt originates from a blocklisted country or region, Falcon treats the activity as suspicious and generates a detection or contributes to increased identity risk.

By contrast:

An Allowlist defines approved locations and suppresses detections.

A Dictionary is used for password-related analysis.

An Exclusion suppresses detections rather than generating them.

Because geolocation detections are triggered byblocklisted locations,Option Ais the correct answer.