4.4 Identify Vulnerabilities and Installed Packages CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is reviewing Falcon's vulnerability findings for a Linux VM and notices that a package is listed as vulnerable, but the engineer believes the package is not actually installed. What is the most likely reason for this discrepancy?

   • AThe package was installed as a dependency and later removed, but the vulnerability data is cached.
   • BThe package is listed in the package manager's database but is not present on the file system.
   • CFalcon is incorrectly identifying the package due to a sensor bug.
   • DThe vulnerability is from a different package with a similar name.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What type of information does CrowdStrike's installed package discovery provide for a cloud workload?

   • AA list of open ports and services
   • BA list of running processes and their network connections
   • CA list of installed software packages and their versions
   • DA list of user accounts and their permissions
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of CrowdStrike's pre-runtime vulnerability identification for cloud workloads?

   • ATo provide real-time threat intelligence feeds
   • BTo detect active exploits in running workloads
   • CTo monitor network traffic for malicious activity
   • DTo identify vulnerabilities in workloads before they are deployed
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company runs a critical application on a Google Cloud VM that has a known critical vulnerability in a third-party library. The vulnerability cannot be patched immediately because the vendor has not released a fix. The security team wants to ensure that this vulnerability does not lead to a runtime compromise while the patch is pending. Which combination of actions best leverages CrowdStrike's capabilities?

   • ARely solely on Falcon's prevention policy to block all exploitation attempts automatically.
   • BDisable the Falcon sensor's vulnerability scanning to reduce false positives.
   • CRemove the VM from the network until the patch is available.
   • DUse Falcon's vulnerability data to create a custom IOA rule that detects exploitation attempts against the vulnerable library, and enable runtime protection.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security engineer is reviewing a newly onboarded Azure VM that runs a legacy line-of-business application. The engineer wants to identify which installed packages on the VM are associated with known Common Vulnerabilities and Exposures (CVEs) before the application is promoted to production. The engineer has already installed the CrowdStrike Falcon sensor and confirmed the host is visible in the console. What should the engineer do to obtain this information?

   • ANavigate to the host's vulnerability details in the Falcon console and review the detected CVEs mapped to installed packages.
   • BCheck the Falcon console's event search for package installation logs.
   • CDeploy Azure Security Center's vulnerability assessment solution to the VM instead.
   • DRun a manual package enumeration script on the VM and cross-reference the output with a public CVE database.
   Reveal Solution Discussion Select an answer first