Question 1

Which step is essential when registering a cloud account in Falcon Cloud Security?

Options :

A : Enabling API access and permissions to allow CrowdStrike to monitor the account.

B : Deploying the Falcon agent on all instances in the account before registration.

C : Configuring automatic backup settings for all cloud resources.

D : Configuring network firewalls to route all traffic through CrowdStrike-s servers.

Answer: A

Question 2

While editing the cloud security posture policy in Falcon to enhance compliance with industry standards, you notice a rule that detects misconfigured IAM roles in your AWS environment. What action should you configure for this rule to prevent unauthorized access effectively?

Options :

A : Set the action to "Alert" and notify the security operations team.

B : Enable auto-remediation to delete all misconfigured IAM roles immediately.

C : Add a condition to the rule requiring all IAM roles to use least-privilege policies.

D : Set the action to "Monitor Only" to track usage of the misconfigured roles.

Answer: C

Question 3

A company wants to create a Falcon Sensor policy to enforce strict monitoring on critical servers. What is an essential configuration step for the policy?

Options :

A : Configure prevention settings such as "Exploit Mitigation" and "Malware Prevention" for the policy.

B : Set the policy mode to "Detection Only" for all servers.

C : Add the policy under the "Sensor Exclusions" tab in the Falcon Console.

D : Assign the policy to the "Default Group" to ensure global coverage.

Answer: A

Question 4

You are creating a custom Indicator of Maliciousness (IOM) rule in CrowdStrike Falcon to block access to a specific malicious domain. Which of the following steps is correct for ensuring the IOM rule functions effectively?

Options :

A : Use the "File Hash" condition type to specify the domain’s IP address.

B : Assign the IOM rule a severity level of "Informational" to ensure it blocks the domain.

C : Add the domain to the Global Allowlist to ensure it is blocked.

D : Select the "Domain Name" condition type and specify the domain to block.

Answer: D

Question 5

When using the Identity Analyzer feature in CrowdStrike CIEM to identify inactive users, which data source is primarily used to assess inactivity?

Options :

A : Audit trails of API calls and resource utilization.

B : Historical security alerts from CrowdStrike Falcon.

C : Network traffic logs from connected endpoints.

D : CrowdStrike Falcon sensor telemetry.

Answer: A

Higher Test Marks with Free Online CCCS-203b Exam Practice

Buying Options: