4.4 Identify Vulnerabilities and Installed Packages CCCS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a mix of Windows and Linux workloads in Azure and AWS. They want to use Falcon's vulnerability data to create a unified view of risk across both cloud providers. The security team needs to generate a report that shows the top 10 most vulnerable hosts across the entire environment. What is the most efficient way to achieve this?

   • ARun separate Falcon reports for Azure and AWS and manually merge the results.
   • BExport vulnerability data from each cloud provider's native security tool and combine it in a spreadsheet.
   • CUse Falcon's built-in reporting and dashboard features to filter and sort hosts by vulnerability severity across all cloud providers.
   • DUse a third-party BI tool to query Falcon's API and build a custom dashboard.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization has a strict compliance requirement to maintain an accurate inventory of all software packages on their cloud workloads. They use Falcon for vulnerability management, but they are concerned that some packages installed via custom scripts may not be captured. What is the most effective way to ensure the package inventory is as complete as possible?

   • ARely on the cloud provider's native inventory service to track all packages.
   • BUse Falcon's sensor to continuously monitor and report on installed packages, and periodically cross-check with a configuration management database (CMDB).
   • CRun a one-time vulnerability scan during each compliance audit.
   • DRequire all software installations to be performed through a central package manager and disable manual installations.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A system administrator is reviewing the Falcon vulnerability report for a CentOS VM and notices that a package is listed with a version that does not match the version installed on the system. The administrator confirms the installed version is different. What is the most likely cause of this discrepancy?

   • AFalcon is reading the package version from a different repository.
   • BThe package manager has a bug that reports incorrect versions.
   • CThe package was updated after the last Falcon vulnerability scan.
   • DThe sensor is configured to report the latest available version instead of the installed version.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is reviewing a Falcon vulnerability report for a container image and sees a CVE listed as 'not applicable' for the image. The team wants to understand why this CVE is not applicable. What is the most likely reason?

   • AThe package containing the vulnerability is not present in the image.
   • BThe CVE is a false positive from the scanner.
   • CThe image is running on a different operating system than the CVE affects.
   • DThe CVE has been patched in a later version of the package.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A system administrator is troubleshooting why a specific package is not appearing in Falcon's vulnerability report for a Windows VM. The package was installed using a custom installer that does not use the standard Windows Installer (MSI) service. What is the most likely reason Falcon is not detecting this package?

   • AThe sensor needs to be restarted to detect newly installed packages.
   • BFalcon only scans packages installed via MSI or the Windows Update service.
   • CThe package is not vulnerable, so Falcon does not report it.
   • DThe custom installer placed files in a non-standard directory that Falcon does not scan.
   Reveal Solution Discussion Select an answer first