5.4 Identify Unassessed Images Used in Production CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An image in CrowdStrike has the status 'Unassessed'. What does this status label tell the security team about the image?

   • AThe image has been scanned and found to have critical vulnerabilities
   • BThe image is currently being scanned by CrowdStrike
   • CThe image has not been evaluated for vulnerabilities or compliance
   • DThe image is compliant with all security policies
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is investigating a potential vulnerability in a containerized application. They have identified a running container in production, but the underlying image shows 'Not Assessed' in CrowdStrike. The team needs to understand the risk. What is the most effective next step?

   • ATrigger an on-demand assessment of the image from the CrowdStrike console to get vulnerability and compliance data.
   • BCompare the image's SHA-256 hash against a public vulnerability database.
   • CCheck the container's runtime logs for any signs of exploitation.
   • DReview the image's Dockerfile to manually identify potential vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst at a financial services firm is reviewing the CrowdStrike Cloud Security console. The firm runs a mix of containerized workloads in Azure Kubernetes Service (AKS). The analyst filters the 'Images' view and notices that several images show a status of 'Not Assessed'. These images are actively running in production clusters. What is the most immediate security concern the analyst should report to the team lead?

   • AThe images are quarantined by the container runtime and are not actually executing workloads.
   • BThe images are running without a completed vulnerability or compliance assessment, so known vulnerabilities may be present and undetected.
   • CThe images have been assessed but the results are pending a manual review by an administrator.
   • DThe images are automatically blocked from being pulled by the container registry.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security engineer is using the CrowdStrike Falcon console to investigate a potential security gap. The engineer needs to find all containers running in a specific namespace that are using images without an assessment. How can the engineer accomplish this?

   • AUse the 'Detections' view, filter by the namespace, and then check the image assessment status.
   • BUse the 'Images' view, filter by the namespace, and then check the container status.
   • CUse the 'Containers' view, filter by the namespace, and then check the image assessment status for each container.
   • DUse the 'Hosts' view, filter by the namespace, and then check the image assessment status.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An analyst wants to programmatically retrieve a list of all unassessed images in production. Which CrowdStrike resource should they use?

   • AThe Falcon Sensor's command-line interface
   • BThe cloud provider's native container registry API
   • CThe Falcon API's image assessment endpoints
   • DThe Kubernetes API server directly
   Reveal Solution Discussion Select an answer first