Question 1

While editing the cloud security posture policy in Falcon to enhance compliance with industry standards, you notice a rule that detects misconfigured IAM roles in your AWS environment. What action should you configure for this rule to prevent unauthorized access effectively?

Options :

A : Set the action to "Alert" and notify the security operations team.

B : Enable auto-remediation to delete all misconfigured IAM roles immediately.

C : Add a condition to the rule requiring all IAM roles to use least-privilege policies.

D : Set the action to "Monitor Only" to track usage of the misconfigured roles.

Answer: C

Question 2

Which of the following is the most critical step when configuring an automated remediation workflow in Falcon Fusion for AWS findings?

Options :

A : Configure the workflow to delete all flagged resources immediately upon detection.

B : Integrate AWS Security Hub with Falcon Fusion to detect findings.

C : Set up appropriate triggers and actions for specific AWS findings.

D : Ensure IAM roles in AWS grant unrestricted access for remediation actions.

Answer: C

Question 3

What is the primary step required to deprovision a cloud account from Falcon in the CrowdStrike platform?

Options :

A : Disable the cloud account integration in the Falcon console under the "Cloud Accounts" tab.

B : Delete the cloud account directly from the cloud provider-s console to automatically deprovision it from Falcon.

C : Remove all workloads and endpoints linked to the cloud account before attempting to deprovision it.

D : Revoke the API client credentials associated with the cloud account in the "API Clients and Keys" section.

Answer: A

Question 4

What is the recommended action after CrowdStrike Falcon identifies a potentially malicious network connection in a containerized workload?

Options :

A : Rely on cloud provider firewall logs to verify the nature of the connection.

B : Re-scan the container image used by the workload to identify vulnerabilities.

C : Automatically restart the affected container to terminate the malicious connection.

D : Block the container-s network access and perform a forensic investigation of the workload.

Answer: D

Question 5

Which method is most effective for identifying Indicators of Attack (IOAs) in a cloud-native environment?

Options :

A : Implement runtime monitoring via Kubernetes native tools such as kube-audit

B : Utilize CrowdStrike’s integration with cloud-native APIs for IOA detection

C : Deploy a CrowdStrike Falcon sensor on all endpoints

D : Rely on cloud provider security tools like AWS GuardDuty or Azure Security Center

Answer: B

Free CCCS-203b Mock Exam – Practice Online Confidently

Buying Options: