5.2 Troubleshoot Issues Related to Kubernetes and Container Sensor Deployment CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A containerized application is running with a read-only root filesystem. The CrowdStrike sensor container is failing to start. Which adjustment is most likely to resolve the issue?

   • AChange the sensor container's image pull policy to Always
   • BMount a writable volume for the sensor's data directory
   • CSet the sensor container's working directory to /tmp
   • DIncrease the sensor container's memory limit
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team deployed the CrowdStrike Falcon sensor to a Kubernetes cluster using a Helm chart. After deployment, the Falcon pods are in a CrashLoopBackOff state. The team checks the pod logs and sees repeated 'Failed to connect to CrowdStrike cloud' errors. The cluster nodes have outbound internet access through a NAT gateway. Which configuration should the team verify first?

   • AThe resource limits set on the Falcon sensor pod
   • BThe Kubernetes API server's authentication token used by the Falcon sensor
   • CThe cluster's DNS configuration for resolving internal service names
   • DThe Falcon sensor's proxy configuration and the cluster's egress firewall rules for the CrowdStrike cloud domains
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is deploying the CrowdStrike Falcon sensor to containers running in Azure Container Instances (ACI). The containers start successfully, but the sensor is not appearing in the Falcon console. The container image is based on a minimal distroless image. What is the most likely reason the sensor is not functioning?

   • AAzure Container Instances does not support running privileged containers
   • BThe Falcon sensor cannot run in any containerized environment
   • CThe distroless image lacks the necessary libraries and binaries required by the Falcon sensor
   • DThe container's network policy is blocking outbound traffic to the CrowdStrike cloud
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A Kubernetes administrator is deploying the CrowdStrike sensor via a Helm chart. The sensor pods are in a CrashLoopBackOff state. Which log source should the administrator check first to identify the root cause?

   • AThe CrowdStrike Falcon console event search
   • BThe sensor container's stdout/stderr logs
   • CThe kubelet logs on the worker nodes
   • DThe Kubernetes API server audit logs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team is deploying the Falcon sensor to containers running on Amazon ECS with the EC2 launch type. The sensor is configured as a sidecar container in the task definition. The task starts, but the sensor container exits with a non-zero exit code. The team checks the logs and sees 'Failed to load kernel module'. What is the most likely cause?

   • AThe ECS task is using the Fargate launch type, which does not support privileged containers
   • BThe container is not running in privileged mode, so it cannot load the required kernel module
   • CThe ECS agent is not configured to allow container access to the host's /proc filesystem
   • DThe container image is missing the 'curl' command
   Reveal Solution Discussion Select an answer first