A security analyst is reviewing the CrowdStrike Cloud Security console and sees an image with the status 'Assessed'. The analyst also notices a separate image with the status 'Not Assessed'. Both images are running in the same production cluster. What does the 'Assessed' status indicate about the first image?

The image has been scanned for vulnerabilities and compliance, and the results are available in the console.

The image is confirmed to have no vulnerabilities and is fully compliant with all policies.

The image is currently being scanned and the results will be available soon.

The image is approved for production use by the security team.

A security analyst sees a running container in production. What information does CrowdStrike provide to help the analyst determine if the container's underlying image has been assessed?

The container's associated image ID and its assessment status

The container's creation timestamp and author

The container's network connections and open ports

The container's CPU and memory usage metrics

How does CrowdStrike Cloud Security correlate a running container in production with its underlying image assessment record?

By requiring the developer to manually tag each container with its image assessment ID

By analyzing the container's network traffic to determine its origin

By using the container's image ID and registry metadata to link it to the assessment record

By matching the container's runtime process ID to the image's process list

A large retail company runs a containerized application on AKS. The security team uses CrowdStrike Cloud Security. During a review, they find that a production container is running an image with a status of 'Not Assessed'. The image was pulled from a public registry. The team lead wants to understand the risk and the best course of action. Which statement is most accurate?

The image is blocked from running by CrowdStrike because it is from a public registry.

The image is secure because it is from a public registry and has been vetted by the community.

The image has not been scanned, so the team should trigger an on-demand assessment to identify vulnerabilities.

The image is assessed but the results are hidden because it is from a public registry.

A security administrator is tasked with identifying all production containers that are running images without a completed assessment. The administrator has access to the CrowdStrike Falcon console. Which feature should be used to correlate running containers with their image assessment status?

The 'IOA' (Indicators of Attack) view, which lists behavioral indicators.

The 'Containers' view in Cloud Security, which shows running containers and links to their image assessment status.

The 'Detections' view, which shows active threats and alerts.

The 'Hosts' view, which lists all endpoints and their installed agents.

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 5Objective 4

5.4 Identify Unassessed Images Used in Production CCCS Practice Questions (Page 2)

Part of the Runtime Protection domain, which makes up ~18% of our current practice bank.

15questions here

3free pages

4concepts

Questions 6–10

6application · medium
A security analyst is reviewing the CrowdStrike Cloud Security console and sees an image with the status 'Assessed'. The analyst also notices a separate image with the status 'Not Assessed'. Both images are running in the same production cluster. What does the 'Assessed' status indicate about the first image?
Select an answer first
7foundation · easy
A security analyst sees a running container in production. What information does CrowdStrike provide to help the analyst determine if the container's underlying image has been assessed?
Select an answer first
8foundation · easy
How does CrowdStrike Cloud Security correlate a running container in production with its underlying image assessment record?
Select an answer first
9expert · hard
A large retail company runs a containerized application on AKS. The security team uses CrowdStrike Cloud Security. During a review, they find that a production container is running an image with a status of 'Not Assessed'. The image was pulled from a public registry. The team lead wants to understand the risk and the best course of action. Which statement is most accurate?
Select an answer first
10application · medium
A security administrator is tasked with identifying all production containers that are running images without a completed assessment. The administrator has access to the CrowdStrike Falcon console. Which feature should be used to correlate running containers with their image assessment status?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.

5.4 Identify Unassessed Images Used in Production CCCS Practice Questions (Page 2)

Questions 6–10

A security analyst sees a running container in production. What information does CrowdStrike provide to help the analyst determine if the container's underlying image has been assessed?

How does CrowdStrike Cloud Security correlate a running container in production with its underlying image assessment record?

A security administrator is tasked with identifying all production containers that are running images without a completed assessment. The administrator has access to the CrowdStrike Falcon console. Which feature should be used to correlate running containers with their image assessment status?

Keep studying — Runtime Protection