Question 1

While editing the cloud security posture policy in Falcon to enhance compliance with industry standards, you notice a rule that detects misconfigured IAM roles in your AWS environment. What action should you configure for this rule to prevent unauthorized access effectively?

Options :

A : Set the action to "Alert" and notify the security operations team.

B : Enable auto-remediation to delete all misconfigured IAM roles immediately.

C : Add a condition to the rule requiring all IAM roles to use least-privilege policies.

D : Set the action to "Monitor Only" to track usage of the misconfigured roles.

Answer: C

Question 2

When setting up automated remediation within AWS using CrowdStrike, which of the following steps is essential to ensure actions are executed correctly in response to detected threats?

Options :

A : Enable AWS Trusted Advisor to detect configuration issues.

B : Define IAM roles with least privilege access for CrowdStrike workflows.

C : Assign full administrative privileges to all CrowdStrike Service Principals in AWS.

D : Use AWS Backup to create snapshots of EC2 instances before remediation.

Answer: B

Question 3

Which of the following is the most critical step when configuring an automated remediation workflow in Falcon Fusion for AWS findings?

Options :

A : Configure the workflow to delete all flagged resources immediately upon detection.

B : Integrate AWS Security Hub with Falcon Fusion to detect findings.

C : Set up appropriate triggers and actions for specific AWS findings.

D : Ensure IAM roles in AWS grant unrestricted access for remediation actions.

Answer: C

Question 4

You are a cloud administrator for a company using CrowdStrike's Cloud Infrastructure Entitlement Manager (CIEM) to enhance identity security in the cloud. You want to identify users who have been inactive for the past six months to evaluate whether they need continued access to critical resources. Which of the following steps is the most appropriate way to identify inactive users in CIEM?

Options :

A : Run the "Inactive Users Report" within the CIEM dashboard and filter users by the "Last Activity" timestamp.

B : Search for inactive users by using CIEM-s "High-Risk Permissions" filter.

C : Rely solely on CrowdStrike-s AI recommendations to flag inactive users automatically.

D : Manually cross-reference activity logs from CIEM with logs from your Identity and Access Management (IAM) provider.

Answer: A

Question 5

Which component of Falcon Fusion is primarily responsible for automating responses to detected threats within a cloud environment?

Options :

A : Workflow Builder

B : Event Correlation Dashboard

C : Custom Alerts Manager

D : Threat Intelligence Orchestrator

Answer: A

Confidently Practice Online with Free CCCS-203b Exam Cram

Buying Options: