CCCS-203B Practice Questions

Option A: Admission Controllers provide security and compliance enforcement, and disabling them

would reduce security posture rather than align with image assessment results.

Option B: Applying pod security policies is a general security best practice but is not directly derived

from an image assessment.

Option C: Image assessments identify vulnerabilities and provide actionable recommendations, such as

updating base images or dependencies to mitigate critical security risks.

Option D: Limiting pods per node is a capacity management measure, not an outcome of image

assessments focused on vulnerabilities.

107/192

Option A: Transferring permissions without a clear business need or appropriate analysis can lead to

excessive privilege assignments and violate the principle of least privilege, increasing the risk of insider

threats or accidental misuse.

Option B: Temporarily disabling inactive accounts allows organizations to verify whether the accounts

are genuinely no longer in use while preventing immediate security risks. Monitoring for unexpected

activity during the temporary disablement phase helps identify potential misuse or ongoing necessity of

the account, ensuring informed decisions about deactivation or deletion.

Option C: Deactivating accounts without addressing roles and permissions still poses a security risk.

Inactive accounts with retained permissions can be re-enabled or misused inappropriately.

Option D: While deleting inactive accounts removes potential attack vectors, this approach is risky

without prior analysis. Some accounts may be needed for legacy systems or auditing purposes, leading to

operational disruption.

78/192

Option A: Reassigning the Service Principal does not address the risk of overly permissive roles.

Additionally, using an existing Service Principal for a new purpose can create security challenges

Option B: While deleting the Service Principal may eliminate the risk, this approach can disrupt any

active dependencies. A more controlled remediation involves first reviewing and adjusting permissions.

Option C: Changing the role to "Reader" may reduce risk, but it does not address whether the Service

Principal is still necessary. The root cause (overly permissive roles and lack of usage) should be resolved.

Option D: The most effective action is to evaluate the necessity of the Service Principal and remove any

unnecessary roles or scopes. This minimizes risk while maintaining operational functionality if needed.

Option A: NSGs are an effective way to control network access to resources. Limiting traffic to trusted

IPs reduces the attack surface and is a good security practice.

Option B: Port 22 is typically used for SSH access. Allowing unrestricted inbound traffic to this port

exposes cloud-hosted resources to brute-force attacks and unauthorized access. This is a high-risk practice

and a common misconfiguration that should be remediated by limiting access to trusted IPs or using

VPNs.

Option C: RBAC is a best practice for managing permissions in the cloud. It ensures that users have

access only to the resources they need, reducing the risk of over-privileged accounts. This is not a high-

risk practice.

Option D: MFA is a critical security control that protects against unauthorized access, even if credentials

are compromised. Enforcing MFA is a recommended practice, not a high-risk one.

Option A: Monitoring alone provides visibility but does not address the root cause or prevent potential

security risks from misconfigured IAM roles.

Option B: Adding a condition that enforces least-privilege policies ensures that IAM roles are configured

to minimize unnecessary permissions. This is a proactive approach to reducing the risk of unauthorized

access while aligning with best practices for identity and access management.

Option C: Auto-remediation by deletion is overly aggressive and may disrupt legitimate operations,

especially in production environments.

Option D: While alerts provide visibility, they do not actively enforce secure configurations. This action

is insufficient for preventing unauthorized access.

Option A: While the Falcon Overwatch team provides expert threat hunting, Falcon Cloud Security also

relies on automated analytics and AI-based detection. This ensures a comprehensive approach to

identifying and mitigating threats without solely depending on human oversight.

Option B: Falcon modules are designed to work together seamlessly, automatically correlating data to

provide actionable insights. Manual correlation is not required, and suggesting otherwise misrepresents

the platform’s automation and integration capabilities.

Option C: While Falcon Cloud Security can interact with third-party APIs for extended functionality, it

has native capabilities to detect misconfigurations and threats in cloud environments. This reduces

dependence on external tools.

Option D: Falcon Cloud Security leverages integration with modules like Falcon Horizon for cloud

posture management and Falcon Prevent for real-time prevention. These integrations streamline

vulnerability detection and workload protection without requiring extensive manual configuration.

Option A: Scheduled reports must be configured with specific parameters such as data sources (cloud

assets, compliance findings, threat detections), reporting frequency (daily, weekly, monthly), and delivery

methods (email, dashboard, or external integrations).

Option B: While admin-level users can configure reports, role-based access control (RBAC) in

CrowdStrike allows specific roles, such as security analysts, to set up and receive reports without full

platform access.

Option C: Scheduled reports do not perform automatic mitigation; they provide insights and

recommendations, but security teams must take action based on the findings.

Option D: Scheduled reports are automated, meaning that once configured, they are generated

periodically without requiring manual execution.

72/192

Option A: Default Falcon registry settings may not cover all organizational needs. Custom configurations

should be made to ensure alignment with security policies.

Option B: Allowing all registries without authentication increases security risks, as unauthorized or

malicious images can be pulled and deployed.

Option C: To ensure pre-runtime protection, administrators should define registry connection details,

specify the registry URL, enable authentication (if needed), and set image scanning policies for security

compliance.

Option D: Private repositories are not automatically secure. Vulnerabilities can still exist in private

images, making it critical to enable scanning even for internal sources.

Option A: Data visibility is not tied to re-registration within a specific timeframe. Historical data is

retained regardless of whether the account is re-registered or permanently deprovisioned. This answer

introduces an unnecessary restriction.

Option B: CrowdStrike retains historical data for compliance and forensic purposes. Immediate and

permanent deletion would hinder post-deprovisioning investigations or audits, which is not the intended

behavior of the Falcon platform.

Option C: There is no automatic data archival or deletion process tied to deprovisioning a cloud account

in Falcon. Historical data remains accessible for an extended period, as determined by organizational data

retention policies.

Option D: When a cloud account is deprovisioned from Falcon, the platform stops collecting new data

and generating alerts for the account. However, historical data and alerts are retained for compliance and

auditing purposes. This ensures organizations can review past activity and investigate incidents even after

the account is deprovisioned.

Option A: Allowing inbound traffic on port 443 (HTTPS) is a standard practice for secure web services.

While this could be a misconfiguration if unnecessary, it falls under network security rather than identity

management, which is the focus of CIEM.

Option B: Concurrency settings relate to resource performance and scalability, not identity or entitlement

management. CIEM does not monitor or manage execution limits for serverless functions.

Option C: CIEM is specifically designed to detect and analyze overly permissive roles and identities,

51/192

particularly when sensitive permissions (like resource deletion) are assigned to multiple non-human

identities. This scenario poses a significant security risk if those identities are compromised or misused.

Option D: This is an expected and secure behavior when proper access policies are in place. CIEM

would not flag this as an issue since the access is authorized and aligns with standard operational

practices.