Question 1

What is the primary action required to enable runtime protection for containers in a cloud environment using CrowdStrike Falcon?

Options :

A : Install the Falcon sensor inside each running container.

B : Update the container runtime (e.g., Docker or containerd) to the latest version.

C : Enable the runtime protection policy within the Falcon console and assign it to a host group.

D : Deploy the Falcon Container Sensor to the host running the container.

Answer: C

Question 2

A security team is tasked with creating an image assessment policy in the Falcon Cloud to scan container images for vulnerabilities before deployment. Which of the following configurations is required to ensure the policy works as intended?

Options :

A : Enable the "Audit Mode" to enforce runtime image assessment.

B : Enable the "Real-time Scanning" option to automatically block all unscanned images.

C : Assign the policy to a specific Kubernetes namespace only.

D : Specify the severity levels (e.g., Critical, High, Medium) for vulnerabilities to flag.

Answer: D

Question 3

Which feature of Falcon Horizon allows users to identify exposed cloud services and workloads running without requiring the deployment of a Falcon sensor?

Options :

A : Real-time behavioral monitoring

B : API-driven cloud workload discovery

C : Vulnerability patching orchestration

D : Deployment of lightweight monitoring agents

Answer: B

Question 4

After identifying excessive permissions and missing MFA in IAM configurations, which remediation strategy is most aligned with CrowdStrike CIEM’s recommendations?

Options :

A : Delete all accounts flagged by CIEM’s Identity Analyzer.

B : Enable MFA and implement least privilege access policies for the flagged accounts.

C : Revoke all permissions from the identified accounts.

D : Transfer ownership of flagged accounts to a different administrator.

Answer: B

Question 5

When using the Identity Analyzer feature in CrowdStrike CIEM to identify inactive users, which data source is primarily used to assess inactivity?

Options :

A : Audit trails of API calls and resource utilization.

B : Historical security alerts from CrowdStrike Falcon.

C : Network traffic logs from connected endpoints.

D : CrowdStrike Falcon sensor telemetry.

Answer: A

Free CrowdStrike-Cloud Mock Exam – Practice Online Confidently

Buying Options: