CrowdStrike Certified Cloud Specialist - CCCS-203b 模擬練習

A. Set the policy mode to "Detection Only" for all servers.

B. Assign the policy to the "Default Group" to ensure global coverage.

C. Add the policy under the "Sensor Exclusions" tab in the Falcon Console.

D. Configure prevention settings such as "Exploit Mitigation" and "Malware Prevention" for the policy.

A. Event search & Asset graph

B. Identity & Cloud group

C. CloudTrail logging & Application Registration

A. They are actively running in your environment but do not have the Falcon Container Sensor installed

B. They are in one of your connected image registries but have never been actively running in your environment

C. They are actively running in your environment but have not been checked for vulnerabilities

D. They are in one of your connected image registries but have not been checked for vulnerabilities

A. Allow developers to register their cloud accounts independently with no oversight to speed up onboarding.

B. Register each cloud account using an administrator's personal access credentials.

C. Use a shared service account with a single set of credentials for registering all cloud accounts.

D. Use an automated cloud registration workflow integrated with identity and access management (IAM) policies.

A. One-click sensor deployment has not been enabled

B. DaemonSet was used for deployment

C. None of the hosts have been restarted

A. Update the container runtime (e.g., Docker or containerd) to the latest version.

B. Deploy the Falcon Container Sensor to the host running the container.

C. Enable the runtime protection policy within the Falcon console and assign it to a host group.

D. Install the Falcon sensor inside each running container.

A. Disable multi-factor authentication (MFA) for the cloud account temporarily.

B. Use the CrowdStrike service account credentials directly to bypass IAM role issues.

C. Assign the CrowdStrike IAM role to the cloud account with all necessary permissions.

D. Ensure that the cloud account is part of an active CrowdStrike subscription.

A. The cloud account must have administrator-level access to all resources within the environment.

B. All cloud account users must be enrolled in Falcon platform authentication prior to registration.

C. The Falcon agent must be installed on all virtual machines in the cloud account before registration.

D. A dedicated IAM role or user with the appropriate permissions must be created and configured for integration.

A. IAM role with read-only permissions for specific services

B. Access to the root account credentials

C. Administrator Access policy for full control of the cloud account

D. Granting SSH access to all cloud-hosted virtual machines

A. Deleting all IAM users associated with the compromised account.

B. Restricting outbound traffic from a compromised instance by updating the Security Group rules.

C. Automatically encrypting all EBS volumes in the AWS account.

D. Triggering a manual review of security logs by the AWS administrator.

A. Delete any images in your registry that are older than 90 days

B. Use a Fusion workflow to hide the results for any images older than 90 days

C. Use theStop assessing images older than (number) of dayssetting

D. Manually hide any results older than 90 days

A. The CIEM policy is not mapped to the appropriate cloud region for the serverless compute service.

B. The cloud provider's native IAM policies are overriding the CIEM policy.

C. The policy does not include a condition to explicitly allow access to the serverless compute service.

D. The users have not been manually added to the "DevOps" role in the cloud provider's IAM system.