5.2 Troubleshoot Issues Related to Kubernetes and Container Sensor Deployment CCCS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A security team is deploying the CrowdStrike sensor as a sidecar container in a pod. The sensor container starts but immediately exits with a non-zero exit code. Which common cause should be investigated first?

   • AThe sensor container's resource limits are too high
   • BThe sensor container's environment variables are missing
   • CThe sensor container's image tag is incorrect
   • DThe sensor container lacks the required Linux capabilities
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   After deploying the CrowdStrike sensor in a Kubernetes cluster, which command-line tool is used to verify that the sensor is running and communicating with the Falcon cloud?

   • Adocker ps
   • Bkubectl get pods
   • Ckubectl logs
   • Dfalconctl
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevOps engineer has deployed the Falcon sensor to a Kubernetes cluster using a DaemonSet. The pods are running, but the engineer wants to verify that the sensor is actually protecting the nodes. Which command or action should the engineer use to validate the sensor's operational status?

   • ACheck the node's system logs for any Falcon-related error messages
   • BRun 'kubectl exec <falcon-pod> -- falconctl -g --aid' to check the Agent ID
   • CVerify that the Falcon pod has a 'Running' status using 'kubectl get pods'
   • DCheck the Falcon console for the nodes to appear in the Hosts list with a 'Protected' status
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A Kubernetes cluster uses a custom container runtime. The CrowdStrike sensor pods are running but the sensor is not detecting containers. Which configuration is most likely missing?

   • AThe Kubernetes node's taints and tolerations
   • BThe sensor's image pull policy
   • CThe sensor's container runtime socket path
   • DThe Kubernetes cluster's DNS configuration
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A team has deployed the Falcon sensor to a Kubernetes cluster using a Helm chart. The sensor pods are running, but the team is unsure if the sensor is correctly configured with the right CID (Customer ID). They want to verify the CID without accessing the Falcon console. Which command should they run inside the Falcon sensor pod?

   • Acat /etc/crowdstrike/cid
   • Bkubectl describe pod falcon-sensor-xxxxx
   • Cfalconctl -g --cid
   • Denv | grep CID
   Reveal Solution Discussion Select an answer first