CrowdStrike CCCS-203b Exam Questions Instant Access

Question 1

You suspect that there is malware in one of your container images.

What can you investigate to confirm this?

ADrift indicators

BContainer alerts

CContainer misconfigurations

DImage detection findings
To confirm whether malware exists within a container image, CrowdStrike Falcon Cloud Security directs investigators to review Image detection findings. These findings are generated during container image assessments, where Falcon performs deep inspection of image layers, binaries, and embedded artifacts.
Image detection findings include indicators of known malware, suspicious executables, malicious scripts, and other threats identified through CrowdStrike's threat intelligence and detection engines. Because container images are often reused across environments, identifying malware at the image level is critical to preventing widespread propagation.
Other options do not directly confirm malware within an image. Drift indicators relate to changes in a running container compared to its original image, not malware embedded in the image itself. Container alerts are typically runtime detections triggered by behavior during execution. Container misconfigurations focus on insecure settings rather than malicious code.
By reviewing image detection findings, security teams can identify infected images early, remediate by rebuilding clean images, and prevent deployment through policy enforcement mechanisms such as the Kubernetes Admission Controller. Therefore, the correct investigation path for suspected malware in a container image is Image detection findings.

Answer : D

Question 2

You are troubleshooting an issue with an Azure account registered in Falcon Cloud Security. The registration appeared to be successful, but certain CSPM operations---including asset inventories and IOM detection---are failing.

How can you securely test the hypothesis that these failed CSPM operations are related to your firewall configuration?

ACheck that you have allowlisted the IP addresses provided in the public-facing CrowdStrike documentation

BBegin investigating another hypothesis as there is no way blocked traffic could be responsible

CTemporarily open up the firewall to all inbound traffic for testing purposes
The secure and recommended way to test whether firewall restrictions are causing CSPM operation failures is to verify that the required CrowdStrike IP addresses are allowlisted. Falcon Cloud Security relies on outbound API communication between CrowdStrike and the cloud provider. If firewall rules block this traffic, asset inventory collection and IOM detection can fail even though registration appears successful.
CrowdStrike publishes a list of IP addresses and endpoints that must be permitted for proper operation. Validating firewall allowlists against this documentation is a low-risk, best-practice troubleshooting step that preserves security controls while testing connectivity assumptions.
Temporarily opening firewalls to all inbound traffic is insecure and strongly discouraged. Dismissing firewall-related causes without validation can delay resolution. Therefore, the correct and secure approach is to check that the CrowdStrike IP addresses are allowlisted.

Answer : A

Question 3

Which are valid attributes when creating an image group?

AImage tags and Image name

BRepository and Image tags

CImage name and Repository

DRegistry and Image name
When creating an image group in CrowdStrike Falcon Cloud Security, valid attributes must align with how container images are uniquely identified and organized. The supported attributes include repository and image tags, which together allow precise grouping of related images.
The repository defines the image namespace or project within a registry, while image tags represent versions or variants such as latest, prod, or semantic versions. Using these attributes enables security teams to target policies and assessments consistently across image versions without relying on static names.
Options involving image name are incorrect because Falcon does not use a standalone image name field for grouping. Image identity is derived from registry, repository, and tag combinations. Registry can be used in some grouping contexts, but for image groups specifically, repository and tag are the valid selectable attributes.
Therefore, the correct answer is Repository and Image tags.

Answer : B

Question 4

You must share remediation recommendations for an IOM in Falcon Cloud Security.

What information found within the IOM Remediation link will help your team address the misconfiguration?

ASeverity of the misconfiguration

BTotal number of misconfigurations found for the related IOM policy

CRelated documentation from the cloud provider
The IOM Remediation link in Falcon Cloud Security provides cloud-provider-specific remediation guidance, which is the most actionable information for addressing misconfigurations. This includes direct links to official documentation from providers such as AWS, Azure, or GCP that explain the correct configuration steps and security implications.
While severity and finding counts help with prioritization, they do not tell teams how to fix the issue. Cloud provider documentation ensures remediation actions are accurate, supported, and aligned with native platform best practices.
CrowdStrike intentionally includes these links to reduce friction between security and cloud operations teams, enabling faster and more reliable remediation. Therefore, the correct answer is Related documentation from the cloud provider.

Answer : C

Question 5

You want to customize the GKE autopilot policy by updating the detection severity (Critical) and the detection type (CIS benchmark deviation) along with Vulnerability ExPRT.ai severities (Critical).

Which combination will trigger the prevention?

AVulnerability ExPRT.ai severities (Critical), Detection severity (Critical)

BVulnerability ExPRT.ai severities (Critical), Detection severity (Critical), Image misconfigurations

CVulnerability ExPRT.ai severities (Critical), Detection severity (Critical), Detection type (CIS benchmark deviation)
In Falcon Cloud Security, prevention actions are triggered when all configured enforcement criteria within a policy are met. When customizing the GKE Autopilot policy, enforcement requires alignment across vulnerability intelligence, detection severity, and compliance context.
By setting:
Vulnerability ExPRT.ai severity = Critical
Detection severity = Critical
Detection type = CIS benchmark deviation
you ensure that both risk-based vulnerability intelligence and compliance deviation severity thresholds are satisfied. This combination confirms that the issue is not only severe but also represents a critical deviation from an accepted security benchmark, justifying prevention.
Omitting the detection type or replacing it with image misconfiguration alone does not meet the enforcement logic required for policy-triggered prevention.
Therefore, Option C is the correct combination that triggers prevention.

Answer : C

Question 6

Which action is required when creating a new image registry connection that accesses a privately hosted registry?

AVerify the registry URL

BConfirm expiration date of the secret for any used service accounts

CAdd CrowdStrike IP addresses to registry allowlists

DVerify the token and secret
When configuring a new image registry connection for a privately hosted container registry in CrowdStrike Falcon Cloud Security, the required and most critical action is to verify the token and secret used for authentication. Private registries require explicit credentials so Falcon can securely access and assess container images for vulnerabilities, malware, and misconfigurations.
CrowdStrike supports multiple private registry types (such as private Docker registries or cloud-native registries with restricted access). In all cases, Falcon relies on valid authentication credentials---typically a token, username/password, or service account secret---to pull image metadata and layers. If these credentials are incorrect, expired, or misconfigured, image assessment will fail even if the registry connection appears configured.
Other options may be relevant in specific environments but are not universally required at creation time. Registry URLs are validated during setup, and allowlisting IP addresses may be necessary only if strict network controls are in place. Secret expiration checks are a maintenance concern, not a mandatory creation step.
Therefore, the required action when creating a private registry connection is to verify the token and secret.

Answer : D

Question 7

You are investigating unassessed images using Falcon Cloud Security.

What widget displays current totals of assessed and unassessed images in the Registry connections section under Image assessment settings?

AImage processing

BAssessed images

CConnection status

DRegistry assessment status
In Falcon Cloud Security, the Registry assessment status widget provides visibility into the current state of container image assessments for connected registries. This widget displays aggregate totals of assessed and unassessed images, allowing analysts to quickly determine whether images are being successfully scanned.
When investigating unassessed images, this widget is the primary starting point because it reflects real-time assessment coverage across all configured registry connections. It helps identify gaps caused by authentication failures, network restrictions, throttling, or configuration limits such as assessment age thresholds.
Other widgets provide narrower views. Image processing focuses on images currently being scanned, Assessed images only shows completed scans without highlighting gaps, and Connection status reflects connectivity health but not assessment coverage.
CrowdStrike documentation and UI design emphasize the Registry assessment status widget as the authoritative summary for image assessment completeness. Therefore, the correct answer is Registry assessment status.

Answer : D

CrowdStrike Certified Cloud Specialist CCCS-203b Exam Questions