CrowdStrike CCCS-203b Exam Questions Instant Access

Question 1

You want to block privileged containers from being executed in your Kubernetes cluster.

What sensor type should you deploy?

AKubernetes Protection Agent

BKubernetes Sensor

CKubernetes Image Assessment at Runtime

DKubernetes Admission Controller
To block privileged containers before they are executed, CrowdStrike recommends deploying the Kubernetes Admission Controller. This component operates at admission time, intercepting Kubernetes API requests and enforcing security policies before workloads are allowed to run.
Privileged containers represent a significant security risk because they can bypass isolation boundaries and access host resources. The Kubernetes Admission Controller can enforce policies that explicitly deny deployments using privileged flags, hostPath mounts, or other high-risk configurations.
Other options do not provide enforcement. Runtime sensors and agents can detect or alert on risky behavior after execution, but they cannot prevent the workload from starting. Image assessment evaluates image content but does not enforce Kubernetes runtime constraints.
Therefore, to proactively block privileged containers, the correct and CrowdStrike-recommended solution is the Kubernetes Admission Controller.

Answer : D

Question 2

How can unassessed images be a security concern in your cloud environment?

AThey are actively running in your environment but have not been checked for vulnerabilities

BThey are actively running in your environment but do not have the Falcon Container Sensor installed

CThey are in one of your connected image registries but have never been actively running in your environment

DThey are in one of your connected image registries but have not been checked for vulnerabilities
Unassessed images pose a security risk because they exist in connected image registries but have not been evaluated for vulnerabilities. Even if they are not currently running, these images can be deployed at any time, potentially introducing critical vulnerabilities, secrets, or malware into production environments.
Falcon Cloud Security emphasizes proactive image assessment to ensure risks are identified before deployment. Unassessed images represent blind spots where vulnerabilities may go unnoticed until runtime, increasing exposure and response time.
Options describing actively running containers are incorrect because running workloads are typically assessed through runtime sensors. The primary concern with unassessed images is their unknown risk posture prior to use.
Therefore, the correct answer is They are in one of your connected image registries but have not been checked for vulnerabilities.

Answer : D

Question 3

What is required to ensure you can retrieve the Falcon KAC image when deploying the Falcon Kubernetes Admission Controller (KAC) with a Helm chart?

ASENSOR_PLATFORM

BFALCON_REGION

CDocker

DAPI client key
When deploying the Falcon Kubernetes Admission Controller (KAC) using a Helm chart, access to CrowdStrike-hosted container images is required. These images are stored in CrowdStrike's private container registry, which requires authentication.
To retrieve the Falcon KAC image, a valid CrowdStrike API client key (client ID and secret) must be provided. This API credential allows Helm to authenticate to the Falcon registry and securely pull the required KAC image during deployment. Without valid API credentials, image retrieval fails, and the KAC deployment cannot complete successfully.
Other options listed do not satisfy this requirement. SENSOR_PLATFORM and FALCON_REGION are configuration parameters used during sensor installation but do not authenticate registry access. Docker itself is not sufficient, as authentication to the CrowdStrike registry is still required.
Therefore, an API client key is mandatory to ensure successful retrieval of the Falcon KAC image during Helm-based deployment.

Answer : D

Question 4

You want to deploy the Falcon sensor using 1-click sensor deployment when AWS Systems Manager is unavailable.

Which IT automation software can you use to generate an inventory of unmanaged workloads?

AJet

BAnsible

CRudder

DPuppet
When AWS Systems Manager (SSM) is unavailable, Ansible is the supported and recommended IT automation tool for generating an inventory of unmanaged workloads and deploying the Falcon sensor using 1-click sensor deployment workflows.
CrowdStrike integrates with Ansible to enable discovery, inventory generation, and automated sensor installation across cloud and on-prem environments. Ansible's agentless architecture makes it especially suitable when native cloud management services are unavailable or restricted.
Other tools listed---Jet, Rudder, and Puppet---are not natively integrated with Falcon's 1-click deployment workflows for unmanaged workload discovery in cloud environments.
Therefore, Ansible is the correct answer.

Answer : B

Question 5

Your company uses more than one cloud for cost optimization to avoid being locked in to one vendor. It saves the company money but adds complexity and visibility issues for your team.

Where can you find all of your compute assets that are managed and unmanaged by CrowdStrike across all supported cloud providers?

AImage Assessment Dashboard

BCompliance Dashboard

CApplication Security Posture Inventory

DCloud Asset Inventory
The Cloud Asset Inventory in CrowdStrike Falcon Cloud Security provides a centralized, normalized view of all compute assets across AWS, Azure, and Google Cloud, regardless of whether they are managed or unmanaged by the Falcon sensor.
This inventory aggregates metadata from cloud provider APIs and Falcon telemetry to present unified visibility into virtual machines, cloud instances, container hosts, and workloads. Security teams can filter assets by cloud provider, account, region, operating system, sensor status, and risk posture, making it essential for multi-cloud environments.
Other dashboards serve specialized purposes: the Image Assessment Dashboard focuses on container images, the Compliance Dashboard maps findings to regulatory frameworks, and Application Security Posture Inventory focuses on application-level risk. None of these provide the full compute asset view required for cross-cloud operational awareness.
Therefore, Cloud Asset Inventory is the correct location for maintaining visibility across complex, multi-cloud environments.

Answer : D

Question 6

What is needed to achieve visibility into the latest AWS IAM 1020 restricted use of AWS CloudShell with the latest CIS Foundations Benchmarks for AWS, Azure, and Google Cloud?

ALeverage existing IOA policy

BCreate custom IOA policy

CCreate custom IOM policy

DLeverage existing IOM policy
Visibility into AWS IAM controls, including restricted use of AWS CloudShell (CIS IAM 1.20), is provided through CrowdStrike Falcon Cloud Security posture management using Indicators of Misconfiguration (IOMs). These checks continuously evaluate cloud resources against industry-standard benchmarks, including the CIS Foundations Benchmarks for AWS, Azure, and Google Cloud.
CrowdStrike maintains prebuilt, managed IOM policies that are automatically updated to reflect the latest CIS guidance. Leveraging existing IOM policies ensures immediate coverage without the operational risk or overhead of creating and maintaining custom rules. These policies assess IAM configurations, permissions usage, service access controls, and policy enforcement related to CloudShell usage.
IOAs are designed for runtime behavioral detections and are not suitable for posture or configuration validation. Creating custom IOMs is unnecessary for CIS-aligned controls because CrowdStrike already provides validated, benchmark-mapped policies maintained by CrowdStrike security research.
Therefore, leveraging existing IOM policies is the correct and recommended approach to maintain continuous, benchmark-aligned visibility across multi-cloud environments.

Answer : D

Question 7

What can you use to specify which assets to check against IOMs and Image assessment policies while leveraging the Falcon Kubernetes Admission Controller?

APod or Service labels only

BNamespaces only

CNamespaces and Pod or Service labels
When using the Falcon Kubernetes Admission Controller, CrowdStrike allows administrators to precisely scope which Kubernetes assets are evaluated against Indicators of Misconfiguration (IOMs) and Image Assessment policies by using both namespaces and pod or service labels.
Namespaces provide a logical boundary within Kubernetes clusters, often representing environments such as dev, staging, or production. Labels add further granularity by identifying workloads based on application, team ownership, or deployment tier. By combining namespaces and labels, security teams can enforce policies with fine-grained control while minimizing unintended enforcement.
Using only namespaces or only labels limits flexibility and may lead to over- or under-enforcement. CrowdStrike documentation supports the combined approach as a best practice for scalable and precise policy enforcement in Kubernetes environments.
Therefore, the correct answer is Namespaces and Pod or Service labels.

Answer : C

CrowdStrike Certified Cloud Specialist CCCS-203b Exam Questions