5.2 Troubleshoot Issues Related to Kubernetes and Container Sensor Deployment CCCS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying the Falcon sensor to a Kubernetes cluster that uses a service mesh (Istio) with sidecar injection enabled. After deploying the sensor as a DaemonSet, the Falcon pods are running, but the sensor is not reporting to the Falcon console. The team suspects the sidecar proxy is interfering. What should they do to resolve this?

   • ADisable the service mesh entirely for the entire cluster
   • BIncrease the resource limits on the Falcon DaemonSet pods
   • CAdd an annotation to the Falcon DaemonSet to exclude it from Istio sidecar injection
   • DChange the Falcon sensor's service account to a cluster-admin role
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is deploying the Falcon sensor to a Kubernetes cluster that uses a private cluster (no public IP addresses on nodes). The cluster has a private DNS resolver and uses a VPC endpoint to reach AWS services. The Falcon sensor pods are running, but the sensor is not reporting to the Falcon console. The team has verified that the CID is correct. What is the most likely cause?

   • AThe Falcon sensor cannot resolve the CrowdStrike cloud domains because the private DNS resolver does not have the necessary records
   • BThe Falcon sensor requires a public IP address to function
   • CThe Falcon sensor is not compatible with the cluster's Kubernetes version
   • DThe Falcon sensor's service account lacks the necessary RBAC permissions
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps engineer has deployed the Falcon sensor to a Kubernetes cluster. The sensor pods are running, but the engineer wants to confirm that the sensor is actively monitoring the node. Which of the following is the most reliable indicator that the sensor is functioning correctly?

   • AThe Falcon sensor pod has been running for more than 10 minutes without restarting
   • BThe node appears in the Falcon console with a 'Protected' status
   • CThe Falcon sensor has a valid CID configured
   • DThe Falcon sensor pod has a 'Running' status in Kubernetes
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Kubernetes administrator needs to confirm that the CrowdStrike sensor is actively monitoring containers in the cluster. Which indicator in the Falcon console would provide this confirmation?

   • AThe sensor's image pull policy is set to Always
   • BThe sensor's last seen timestamp is recent
   • CThe sensor's resource usage is below 10%
   • DThe sensor's pod is in Running state
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is deploying the Falcon sensor to containers running on Google Kubernetes Engine (GKE) with Container-Optimized OS (COS) nodes. The sensor pods are running, but the sensor is not reporting to the Falcon console. The team has verified the CID and network connectivity. What is the most likely cause?

   • ACOS nodes have a locked-down kernel that prevents the Falcon sensor from loading its kernel module
   • BThe Falcon sensor is not compatible with the GKE Kubernetes version
   • CGKE does not support privileged containers
   • DThe Falcon sensor requires a public IP address to function
   Reveal Solution Discussion Select an answer first