3.1 Given a Use Case, Configure CSPM Policies CCCS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a single AWS account with multiple VPCs. They have a CSPM policy that detects VPC Flow Logs being disabled. The security team wants to apply this policy to the VPCs in the 'production' VPC group only, but the CSPM platform only supports assignment at the account level. What is the best way to achieve the desired scoping?

   • AUse a resource tag (e.g., 'environment=production') on the VPCs and configure the policy to filter by that tag.
   • BApply the policy to the account and manually ignore findings from non-production VPCs.
   • CCreate a separate policy for each VPC and enable them only for production VPCs.
   • DApply the policy to the account and set the severity to Low so that non-production findings are less visible.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company uses CrowdStrike CSPM to monitor its multi-cloud environment (AWS, Azure, GCP). They want a single policy that detects unencrypted storage resources across all three clouds. The policy should flag S3 buckets without default encryption, Azure storage accounts without encryption, and GCP buckets without encryption. What is the best way to configure this?

   • ACreate three separate policies, one for each cloud provider, each with the appropriate check for that provider.
   • BCreate a single policy that uses a generic 'storage encryption' check that applies to all cloud providers.
   • CCreate a single policy and assign it to all cloud accounts, and rely on the platform to automatically map the check to each provider.
   • DCreate a single policy that checks for 'S3 bucket default encryption' and assign it to all cloud accounts.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After configuring a CSPM policy, what is the primary way to validate that it is working correctly?

   • AEnsure the policy is named correctly
   • BConfirm that the policy is assigned to a resource group
   • CCheck that the policy generates a finding for a known misconfiguration
   • DVerify that the policy has a high severity level
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses CrowdStrike CSPM to monitor GCP. They have a policy that flags Cloud Storage buckets with 'uniform bucket-level access' disabled. The security team finds that the policy generates too many low-priority alerts and wants to reduce noise while still catching the most critical cases. Which configuration change best addresses this?

   • ADisable the policy and create a new one that checks for 'bucket policy allows public access'.
   • BIncrease the severity of the policy to Critical so that only the most severe findings are surfaced in the main dashboard.
   • CAdd a condition to the policy so it only triggers when the bucket also has 'public access prevention' not enforced.
   • DChange the enforcement action from 'Alert' to 'Remediate' so that the issue is automatically fixed.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After deploying a new CSPM policy to detect AWS S3 buckets with 'server-side encryption with AWS KMS' (SSE-KMS) not enabled, you run a validation test. You create a test bucket with SSE-KMS enabled and another without encryption. The policy flags both buckets. What is the most likely cause?

   • AThe policy severity is set too high, causing it to flag all buckets.
   • BThe policy is assigned to the wrong account, so it is evaluating buckets from another environment.
   • CThe policy is using a check for 'default encryption enabled' rather than specifically for SSE-KMS.
   • DThe policy enforcement action is set to 'Remediate', which automatically flags all buckets.
   Reveal Solution Discussion Select an answer first