Question 1

What is the primary step required to deprovision a cloud account from Falcon in the CrowdStrike platform?

Options :

A : Disable the cloud account integration in the Falcon console under the "Cloud Accounts" tab.

B : Delete the cloud account directly from the cloud provider-s console to automatically deprovision it from Falcon.

C : Remove all workloads and endpoints linked to the cloud account before attempting to deprovision it.

D : Revoke the API client credentials associated with the cloud account in the "API Clients and Keys" section.

Answer: A

Question 2

After identifying a risky Azure Service Principal using the CrowdStrike CIEM/Identity Analyzer, what is the most appropriate action to mitigate the risk?

Options :

A : Immediately delete the Service Principal and its associated secrets.

B : Assign the Service Principal an "Owner" role for temporary troubleshooting purposes.

C : Rotate the Service Principal-s credentials and reduce its permissions to the minimum necessary.

D : Replace the Service Principal with a managed identity to eliminate credential-related risks.

Answer: C

Question 3

Which of the following is a requirement for deploying the Kubernetes and Container Sensor in a Kubernetes cluster?

Options :

A : The cluster must have the kube-proxy component disabled.

B : The cluster must have at least three nodes with GPU support.

C : The sensor requires a DaemonSet to be deployed within the Kubernetes cluster.

D : All workloads in the cluster must use privileged containers.

Answer: C

Question 4

After identifying excessive permissions and missing MFA in IAM configurations, which remediation strategy is most aligned with CrowdStrike CIEM’s recommendations?

Options :

A : Delete all accounts flagged by CIEM’s Identity Analyzer.

B : Enable MFA and implement least privilege access policies for the flagged accounts.

C : Revoke all permissions from the identified accounts.

D : Transfer ownership of flagged accounts to a different administrator.

Answer: B

Question 5

A security team is tasked with creating an image assessment policy in the Falcon Cloud to scan container images for vulnerabilities before deployment. Which of the following configurations is required to ensure the policy works as intended?

Options :

A : Enable the "Audit Mode" to enforce runtime image assessment.

B : Enable the "Real-time Scanning" option to automatically block all unscanned images.

C : Assign the policy to a specific Kubernetes namespace only.

D : Specify the severity levels (e.g., Critical, High, Medium) for vulnerabilities to flag.

Answer: D

Confidently Practice Online with Free CCCS-203b Exam Cram

Buying Options: