5.4 Identify Unassessed Images Used in Production CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security administrator is tasked with identifying all unassessed images in production. The administrator has access to the CrowdStrike Falcon console. Which feature provides the most comprehensive list of unassessed images?

   • AThe 'Containers' view, filtered by 'Image Assessment: Not Assessed'.
   • BThe 'Detections' view, filtered by 'Image Assessment: Not Assessed'.
   • CThe 'Hosts' view, filtered by 'Image Assessment: Not Assessed'.
   • DThe 'Images' view, filtered by 'Assessment Status: Not Assessed'.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does the 'Unassessed' status indicate for a container image running in production?

   • AThe image has not yet been scanned for vulnerabilities or checked against compliance policies
   • BThe image is known to be free of vulnerabilities and compliant with all policies
   • CThe image is currently being actively exploited in the environment
   • DThe image has been assessed but failed the compliance check
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst needs to identify container images running in a production Kubernetes cluster that have not been through a vulnerability assessment. Which CrowdStrike Cloud Security capability is specifically designed to surface this information?

   • AThe Falcon OverWatch threat-hunting team's manual review of runtime logs
   • BImage Assessment results filtered to show images with a status of 'Unassessed'
   • CThe Falcon Sensor's real-time kernel event stream
   • DThe Host Isolation feature applied to nodes running unpatched images
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which CrowdStrike Cloud Security tool or interface allows an analyst to query and list container images that lack an assessment status?

   • AThe Falcon Sensor's local configuration file
   • BThe CrowdStrike Falcon API's 'Get Hosts' endpoint
   • CThe Falcon console's Image Assessment dashboard with filters
   • DThe Windows Event Viewer on the host running the containers
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps engineer needs to generate a list of all container images currently running in production that have not been assessed. The engineer has access to the CrowdStrike Falcon console. Which approach directly fulfills this requirement?

   • AQuery the container registry API directly to find images with a 'latest' tag.
   • BCheck the host's local Docker daemon for images with a 'dangling' label.
   • CUse the Cloud Security 'Images' view and apply a filter for 'Assessment Status: Not Assessed'.
   • DReview the Kubernetes audit logs for any image pull events in the last 24 hours.
   Reveal Solution Discussion Select an answer first