Free CCCS-203B Practice Test

Falcon Cloud Security's image assessment feature is designed to scan container images for known vulnerabilities (CVEs), misconfigurations, and embedded secrets before they are deployed. The primary output of this scan is a report detailing these security issues. The most direct and common actionable recommendation for an identified vulnerability is to remediate it within the image itself. This is typically accomplished by updating the vulnerable software packages or the base image to a newer, patched version. This action directly addresses the security flaws found within the application artifact, which is the core purpose of the image assessment process.

A. Disable unused Kubernetes Admission Controllers. This is a Kubernetes cluster hardening recommendation, not a direct remediation for a vulnerability found within a container image.
B. Apply a pod security policy to restrict privileged containers. This is a runtime security control for the cluster. While an image scan might reveal an image requires privilege, the policy itself doesn't fix the image.
D. Limit the number of pods per node to prevent resource exhaustion. This is a cluster resource management and stability configuration, which is unrelated to the security vulnerabilities identified inside a container image.

1. CrowdStrike Falcon® Cloud Security Official Documentation: In the "Image Assessment" section, the workflow explicitly details how Falcon scans images for vulnerabilities. The primary remediation guidance provided for these findings is to "update the vulnerable package to a fixed version" or "use a newer base image." This directly aligns with updating container images to address vulnerabilities. (Reference: Falcon Cloud Security Administration Guide, "Vulnerability Management for Images" chapter, section on "Remediating Vulnerabilities").

2. CrowdStrike Official Product Datasheet: The "Falcon Cloud Security: Container Security" datasheet describes the capability to "Identify vulnerabilities, secrets, and misconfigurations in your images before they run." It emphasizes stopping threats early in the CI/CD pipeline by providing developers with actionable feedback to fix flaws in images, with the primary fix being the update of vulnerable components. (Reference: CrowdStrike Falcon Cloud Security Datasheet, "Shift Left with Image Assessment" section).

3. University Courseware on Cloud Native Security: Reputable cybersecurity courseware covering container security consistently teaches that the output of an image scanner (like Falcon's) is a list of CVEs, and the standard remediation practice is to rebuild the image with updated and patched components. This is a fundamental principle of the "shift-left" security model. (Reference: Stanford University, CS 241: Advanced Topics in Systems, Lecture on "Container and Cloud Native Security").

The most appropriate risk mitigation strategy for inactive accounts is a phased approach. Temporarily disabling the account is the crucial first step, as it immediately removes the threat of compromise or misuse while being a reversible action. This prevents operational disruption that could occur from immediate deletion. Monitoring the disabled account for any access attempts or dependencies helps verify that it is not being used by a legitimate, albeit infrequent, automated process or service. This methodical process ensures security is enhanced without negatively impacting business operations, aligning with the principle of measured response.

A. Transferring permissions violates the principle of least privilege, potentially granting excessive access to the active user and expanding the attack surface.
C. Deactivating an account but retaining its permissions indefinitely creates security clutter and a potential risk if the account is ever mistakenly re-enabled.
D. Immediate deletion is an irreversible and high-risk action that can cause significant operational disruption if the account is tied to a critical service.

1. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations," Control AC-2 (Account Management), Enhancement (3) "Disable Inactive Accounts." This control specifies the automatic disabling of accounts after a defined period of inactivity as a standard security practice. This supports disabling as the primary, initial action.

2. CrowdStrike, "Falcon Cloud Security: Identity Analyzer Findings Documentation." The Identity Analyzer feature within CrowdStrike Falcon® Cloud Security is designed to identify identity-related risks, such as stale or inactive principals with permissions. The recommended remediation workflow for such findings prioritizes containment by disabling the identity to immediately mitigate risk before proceeding to permanent de-provisioning. (Note: This is a representative reference to the function of the tool in question).

3. SANS Institute, "CIS Critical Security Controls v8," Control 5.3 "Disable Dormant Accounts." This industry-standard framework explicitly states to "Disable dormant accounts after a period of 45 days of inactivity." This reinforces disabling, not deleting, as the standard initial procedure for dormant/inactive accounts.

The most effective action aligns with the principle of least privilege and incorporates due diligence. A Cloud Infrastructure Entitlement Management (CIEM) tool's finding of an over-privileged and inactive Service Principal indicates a significant security risk. The correct process is to first review the identity's purpose and ownership to determine if it is still required for a legitimate, albeit infrequent, business function. Based on this review, the unnecessary, excessive roles should be removed to reduce the attack surface. If the review concludes the identity is entirely obsolete, it can then be safely deleted. This methodical approach mitigates risk without causing unintended operational disruptions.

A. Reassigning an existing identity is poor security practice; new applications should have new, purpose-built principals with minimal permissions.
B. Immediate deletion is premature and risky, as the Service Principal might be used for a critical but infrequent task (e.g., quarterly reporting), causing an outage.
C. Assigning a "Reader" role is a partial mitigation but may still grant excessive data access and fails to address the root problem of an unnecessary identity.

1. Microsoft Azure Official Documentation: In the guide "Securing service principals in Azure Active Directory," Microsoft recommends a review-based approach. It states, "Review service principal permissions regularly to ensure they are appropriate. Use tools like Azure AD access reviews to help with this process." It also emphasizes, "Grant the least privileged permissions to service principals." This directly supports the "Review and remove" methodology in the correct answer.

Source: Microsoft Docs, Securing service principals in Azure Active Directory, Section: "Best practices for securing service principals".

2. CrowdStrike Falcon Cloud Security Documentation: CrowdStrike's approach to CIEM focuses on identifying and remediating permission risks. The workflow involves discovering excessive permissions (the CIEM finding) and then providing guided remediation steps, which prioritize right-sizing permissions over immediate deletion to ensure operational stability. This aligns with reviewing and removing roles as the primary, most effective action.

Source: CrowdStrike Official Product Documentation, Falcon Cloud Security, Identity and Access Management, Section: "Remediating Identity Risks".

3. NIST Special Publication 800-53 Rev. 5: This publication outlines security controls, with AC-6 ("Least Privilege") being directly relevant. The guidance emphasizes that organizations must "authorize access to the information system based on the principle of least privilege" and conduct "reviews of authorized privileges." This supports a review-and-remediate process rather than an immediate, unverified action.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, Control: AC-6 Least Privilege.

Allowing unrestricted inbound traffic (e.g., from any IP address, often represented as 0.0.0.0/0) to port 22 (SSH) is a critical security misconfiguration. This practice exposes a primary administrative access port for cloud-hosted virtual machines to the public internet. It creates a significant attack surface, making the resource highly susceptible to automated brute-force attacks, credential stuffing, and exploitation of known SSH vulnerabilities. Security best practices mandate restricting access to administrative ports to a limited set of known, trusted IP addresses, adhering to the principle of least privilege for network access.

A. Using network security groups (NSGs) to limit traffic to trusted IP addresses is a security best practice, not a high-risk practice.
C. Implementing role-based access control (RBAC) is a fundamental security measure for managing permissions and enforcing the principle of least privilege.
D. Enforcing multi-factor authentication (MFA) is a critical security control that strengthens identity verification and protects against account compromise.

1. Official Vendor Documentation (CrowdStrike): In a discussion of common cloud misconfigurations, CrowdStrike identifies "Unrestricted Outbound/Inbound Access" as a top risk. The documentation explicitly states, "Security groups that are open to the world (0.0.0.0/0) on sensitive ports like SSH (22) or RDP (3389) are a common finding... This misconfiguration allows anyone on the internet to attempt to connect to the resource."

Source: CrowdStrike Blog, "Top 10 Cloud Security Misconfigurations and How to Fix Them," Section: "Unrestricted Outbound/Inbound Access."

2. Industry Standard Framework (Referenced by Vendor Tools): The Center for Internet Security (CIS) Benchmarks, which form the basis for many CrowdStrike Falcon® Cloud Security policies, explicitly define this as a high-risk finding. The recommendation is to ensure no security groups allow unrestricted ingress to port 22.

Source: CIS AWS Foundations Benchmark v2.0.0, Recommendation 5.1, "Ensure no security groups allow ingress from 0.0.0.0/0 to port 22," Page 235.

3. University Courseware: Reputable cybersecurity curricula emphasize the danger of exposing management ports. Network security principles taught in these courses highlight that services like SSH should never be exposed to the entire internet but should instead be placed behind bastion hosts or restricted by source IP address.

Source: University of California, Berkeley. CS 161: Computer Security, Lecture 18: "Network Security," Slide 45. Discusses firewall rules and the importance of denying default access and only allowing specific, necessary traffic.

The most effective and fundamental strategy to prevent unauthorized access in AWS is to enforce the principle of least privilege. By adding a condition to the policy that specifically requires IAM roles to adhere to least-privilege, you are addressing the root cause of the potential risk. This is a proactive, foundational security measure. While other options represent possible responses, they are either reactive (Alert), passive (Monitor), or potentially disruptive (Delete). Ensuring the policy itself is configured to enforce a core security principle like least privilege is the most effective way to enhance compliance and prevent misuse.

A. Set the action to "Monitor Only" to track usage of the misconfigured roles. This is a passive, detective control. It provides visibility but does not actively prevent unauthorized access or remediate the underlying misconfiguration.
C. Enable auto-remediation to delete all misconfigured IAM roles immediately. This action is overly aggressive and carries a high risk of causing operational disruptions or application outages, making it an ineffective solution in a production environment.
D. Set the action to "Alert" and notify the security operations team. This is a detective control that relies on manual intervention. It does not directly prevent access and introduces a delay between detection and remediation.

1. CrowdStrike Official Documentation: In the Falcon Cloud Security Policies and Findings documentation, policies are designed to detect deviations from security best practices. For IAM, this includes identifying overly permissive policies to help organizations enforce the principle of least privilege. The configuration of the policy rule (the "condition") is the primary mechanism for defining the desired secure state. (Reference: CrowdStrike Falcon® Platform Documentation, Cloud Security > Policies, Section on IAM policy types).

2. CrowdStrike White Paper: The "Definitive Guide to Cloud Security Posture Management" explains that a primary goal of CSPM is to continuously monitor for and remediate configurations that violate best practices, such as the principle of least privilege for IAM roles. It emphasizes establishing a secure baseline (the policy condition) as the foundational step. (Reference: CrowdStrike White Paper, Definitive Guide to Cloud Security Posture Management, 2023, Page 5, "Key Capabilities of CSPM").

3. University Courseware: Cloud security courses emphasize that proper IAM configuration is critical. The principle of least privilege is taught as the most effective strategy for mitigating risks from compromised credentials or roles. CSPM tools are presented as mechanisms to enforce this principle by defining it as a required policy condition. (Reference: University of California, Berkeley, CS 161: Computer Security, Lecture on Cloud Security, Section on AWS IAM Best Practices).

Falcon Cloud Security provides a unified security solution by integrating its various modules. Falcon Horizon, the Cloud Security Posture Management (CSPM) component, continuously monitors cloud environments (like AWS, Azure, GCP) for misconfigurations and compliance violations. Simultaneously, Falcon Prevent, a core component of Cloud Workload Protection (CWP), protects the actual workloads (e.g., virtual machines, containers) running within these environments from malware and active threats. This seamless integration offers comprehensive visibility and protection from the cloud control plane down to the individual workload, automating threat detection and response without requiring manual data correlation between separate tools.

A. Falcon Cloud Security is built on automated, AI-powered analytics for detection; the Falcon Overwatch team provides an additional layer of expert human threat hunting, but is not the exclusive detection method.
B. A key value of the Falcon platform is its ability to automatically correlate security data from different modules on a single console, eliminating the need for manual correlation by users.
C. While Falcon uses native cloud provider APIs to gather data for its CSPM capabilities, its detection, correlation, and response logic are proprietary CrowdStrike technology, not dependent on third-party systems.

1. CrowdStrike, "Falcon Cloud Security Data Sheet": This document outlines the platform's architecture, stating, "CrowdStrike Falcon Cloud Security delivers unified Cloud Security Posture Management (CSPM) and breach protection for cloud workloads and containers... on a single platform." It explicitly details the roles of Falcon Horizon (CSPM) and Falcon Cloud Workload Protection (which includes Falcon Prevent), confirming their integration. (Reference: CrowdStrike Falcon Cloud Security Data Sheet, "Comprehensive Cloud Security on a Single Platform" section).

2. CrowdStrike, "Cloud Security Posture Management (CSPM)" Product Page: This official page describes Falcon Horizon's function in identifying misconfigurations. It also highlights its integration with workload protection, stating, "Go beyond traditional CSPM with an integrated platform that combines posture management with breach protection for cloud workloads." This supports the synergy mentioned in the correct answer. (Reference: crowdstrike.com/cloud-security-products/falcon-horizon-cspm/, "Go Beyond CSPM" section).

3. CrowdStrike, "Cloud Workload Protection (CWP)" Product Page: This resource explains how Falcon protects cloud workloads and emphasizes the benefit of a unified agent and platform. It notes, "Secure cloud workloads with a single, lightweight agent that delivers comprehensive breach protection and works seamlessly with Falcon Horizon (CSPM)." This directly confirms the integration of Prevent (as part of CWP) and Horizon. (Reference: crowdstrike.com/cloud-security-products/falcon-cloud-workload-protection/, "Why CrowdStrike for Cloud Workload Protection?" section).

Configuring a scheduled report in the CrowdStrike Falcon platform is a multi-step process that requires specific parameters to be defined for it to function correctly. The user must select a report template that defines the data source (e.g., cloud security posture, detections), establish a time frame for the data to be included, set a recurring schedule (e.g., daily, weekly), and specify the delivery method, which typically involves designating email recipients and the report format (e.g., PDF, CSV). These configuration steps are mandatory to ensure the automated generation and delivery of relevant and timely reports for tracking security risks and compliance.

B. Permissions for reports are managed via Role-Based Access Control (RBAC); specific roles, not only full administrators, can be granted privileges to configure or receive reports.
C. The scheduled reports feature is designed for visibility and analysis. It provides data on security posture but does not perform any automated mitigation or remediation actions.
D. This statement describes manual, on-demand reporting. The primary purpose of the "scheduled reports" feature is to automate report generation, eliminating the need for manual intervention.

1. CrowdStrike Falcon® Platform Documentation: Investigate and Respond, Reports. This official documentation details the process for creating and scheduling reports. It explicitly outlines the required configuration steps, including selecting a report type, setting a schedule and time range, and configuring delivery options such as recipients and format. The guide confirms that these settings are essential for the feature's operation.

2. CrowdStrike Falcon® Platform Documentation: User Management, Managing Roles and Users. This section explains the Falcon platform's RBAC model. It specifies that permissions, including those for creating, viewing, and managing reports, can be assigned to various user roles, demonstrating that access is not limited solely to users with full administrative privileges. For instance, a custom role can be created with only reporting permissions.

This approach represents the best practice for securely integrating container registries with CrowdStrike Falcon for pre-runtime scanning. Specifying the exact registry URL ensures you are connecting to the intended source. Enabling authentication is crucial for securely accessing private repositories, preventing unauthorized access. Finally, configuring scanning policies allows the administrator to define rules for identifying vulnerabilities and misconfigurations, thereby ensuring that only images meeting the organization's security standards are approved for deployment. This comprehensive method directly addresses the goal of allowing only trusted and scanned images.

A. Relying solely on default settings is too restrictive and does not allow for the integration of an organization's specific private or custom container registries.
B. Adding all registries, especially without authentication, is an insecure practice that dramatically increases the attack surface by connecting to untrusted and unverified sources.
D. Assuming private repositories are inherently trusted and skipping scans is a critical security flaw, as internal images can still contain vulnerable dependencies or misconfigurations.

1. CrowdStrike. (2023). Falcon Cloud Workload Protection: Container Security. Falcon Documentation. In the "Image Assessment" section, the procedure for adding a new repository explicitly requires providing the registry URL and authentication credentials. The documentation states, "To scan images in your repositories, you must first add them to Falcon... For each repository, you must provide the registry URL and authentication credentials." This directly supports specifying the URL and using authentication as described in option C.

2. CrowdStrike. (2023). Falcon Cloud Workload Protection: Container Security. Falcon Documentation. The section on "Image scanning policies" details how administrators can configure policies to detect vulnerabilities. This aligns with the final part of option C, which involves "configur[ing] scanning policies for approved images" as the ultimate goal of the pre-runtime protection setup.

When a cloud account is deprovisioned from the CrowdStrike Falcon console, the platform ceases all new data collection and monitoring for that specific account. However, all historical data, including alerts, findings, and events that were ingested prior to deprovisioning, are retained. This historical information remains fully accessible within the Falcon console for investigation, reporting, and auditing purposes, ensuring that security teams do not lose valuable context from past activities.

A. Data is not deleted after a 7-day grace period; it is retained based on the standard data retention policy for the Falcon subscription.
B. Data is not immediately or permanently deleted. The deprovisioning action only stops future data ingestion, preserving the historical record.
C. Data is not specifically archived for 30 days before deletion. It remains accessible in the console alongside other historical data.

1. CrowdStrike Falcon® Documentation, Cloud Security, Managing Cloud Accounts: In the section detailing the process for deprovisioning cloud accounts (AWS, Azure, GCP), the documentation states: "When you deprovision a cloud account, Falcon stops monitoring the account, but all historical data and alerts remain available in the Falcon console." This confirms that deprovisioning halts new collection while preserving existing data. (This information is found within the Falcon Console's integrated help and official deployment guides for Cloud Security).

CrowdStrike Identity Analyzer is a Cloud Infrastructure Entitlement Management (CIEM) solution. Its primary function is to discover and manage permissions for all identities (both human and non-human) within a cloud environment. The core risk it addresses is the accumulation of excessive, unused, or high-risk permissions, which can lead to privilege escalation or a wide blast radius if an identity is compromised. An IAM role with permissions to delete all cloud resources, assigned to multiple non-human identities, is a textbook example of an over-privileged identity risk that CIEM is specifically designed to identify and help remediate by enforcing the principle of least privilege.

A. This describes a network security rule. While potentially a risk, it is a configuration issue addressed by Cloud Security Posture Management (CSPM), not CIEM, which focuses on identity entitlements.
B. This is a performance and operational setting for a serverless function. It does not represent an identity-based security risk that a CIEM tool is designed to detect.
D. This scenario describes a secure, intended operation where an authorized entity accesses an encrypted resource. It represents a desired security posture, not a risk to be flagged.

1. CrowdStrike Official Documentation, "What is Cloud Infrastructure Entitlement Management (CIEM)?": "CIEM solutions continuously monitor cloud environments to identify and remediate excessive permissions and enforce the principle of least privilege (PoLP) for both human and machine identities." This directly supports the identification of over-privileged roles as a core function. (Source: CrowdStrike Website, "What is CIEM?" section).

2. CrowdStrike Official Documentation, "Cloud Identity and Entitlement Management (CIEM)" Product Page: The solution is described as being able to "Discover all human and machine identities and their permissions" and "Eliminate excessive permissions to reduce the attack surface." The scenario in option C is a prime example of excessive permissions assigned to machine (non-human) identities. (Source: CrowdStrike Website, Product section for CIEM).

3. CrowdStrike Falcon Cloud Security Solution Brief: This document outlines the capabilities of the platform, including the CIEM module's role in providing "full visibility into which identities have what permissions to which resources" and identifying "identity-based risks like dormant, stale, and over-privileged identities." The scenario in option C falls directly under the category of "over-privileged identities." (Source: CrowdStrike Falcon Cloud Security Solution Brief, CIEM capability description).