4.4 Identify Vulnerabilities and Installed Packages CCCS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deploying a new microservices application on Azure Kubernetes Service (AKS). They want to enforce a policy that prevents pods from running if their images contain high-severity vulnerabilities. The team uses Falcon for pre-runtime protection. Which approach should they take to integrate Falcon's vulnerability data with their CI/CD pipeline?

   • AUse Falcon's admission controller to block pod creation when the image has high-severity vulnerabilities.
   • BManually review Falcon's image assessment reports before each deployment.
   • CUse Falcon's runtime protection to kill pods that are found to be vulnerable after deployment.
   • DConfigure AKS's built-in policy to block images with vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is investigating a potential breach on a Windows Server in AWS. The analyst needs to determine if a specific vulnerable version of a DLL is present on the system. The Falcon sensor is installed and reporting. What is the fastest way to confirm the presence of this specific package version?

   • AQuery the host's package inventory in Falcon and search for the DLL name and version.
   • BReview the Windows Event Logs for DLL registration events.
   • CLog into the server and manually search the file system for the DLL.
   • DRun a vulnerability scan from a separate scanner to identify the DLL.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In CrowdStrike, which feature is used to enumerate installed packages on a cloud workload to assess security risks?

   • AFalcon Discover
   • BFalcon Spotlight
   • CFalcon Sandbox
   • DFalcon Cloud Security's workload inventory
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security architect is designing a pre-runtime protection strategy for a hybrid environment with both Windows VMs and Linux containers. The team wants to block deployments when critical vulnerabilities are found in installed packages. The architect must choose a configuration that uses CrowdStrike's vulnerability data to enforce this policy without blocking legitimate emergency fixes. What is the most appropriate approach?

   • AConfigure the Falcon sensor to quarantine any host with a critical CVE immediately upon detection.
   • BUse Falcon's real-time detection to alert on package installations that match known exploit patterns.
   • CManually review Falcon's vulnerability reports before each deployment and approve or reject based on the report.
   • DEnable Falcon's image assessment policy to fail builds when critical CVEs are present, with an exception list for approved emergency packages.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise is migrating from a legacy vulnerability scanner to CrowdStrike Falcon. They have a compliance requirement to report on all installed packages and their vulnerabilities for every cloud workload. The migration team wants to ensure that Falcon's data is trusted for this purpose. What is the most important step to validate Falcon's package inventory and vulnerability data during the migration?

   • ARun Falcon's vulnerability scan only on a few critical hosts to save resources.
   • BTrust Falcon's data without validation because it is a leading security product.
   • CCompare Falcon's package inventory against the legacy scanner's inventory for a sample of hosts to identify discrepancies.
   • DImmediately disable the legacy scanner to reduce costs.
   Reveal Solution Discussion Select an answer first