5.2 Troubleshoot Issues Related to Kubernetes and Container Sensor Deployment CCCS Practice Questions (Page 4)

Questions 16–19

1. 16expert · hard

   A security team is deploying the Falcon sensor to a Kubernetes cluster that uses a mix of Linux and Windows nodes. The team deploys the sensor as a DaemonSet. The Linux nodes are reporting correctly, but the Windows nodes are not. The team has verified the CID and network connectivity on the Windows nodes. What is the most likely cause?

   • AWindows nodes do not support privileged containers
   • BThe Windows nodes do not have the necessary outbound firewall rules
   • CThe Falcon sensor is not compatible with Windows Server Core
   • DThe DaemonSet is using a Linux-specific container image that cannot run on Windows nodes
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is deploying the Falcon sensor to a Kubernetes cluster that uses a service mesh (Linkerd) with mTLS enabled. The Falcon sensor pods are running, but the sensor is not reporting to the Falcon console. The team has verified the CID, proxy settings, and network connectivity. What is the most likely cause?

   • AThe Falcon sensor is not compatible with Linkerd
   • BThe Falcon sensor requires a service mesh to function
   • CThe Falcon sensor's service account lacks the necessary RBAC permissions
   • DLinkerd's mTLS is intercepting and altering the Falcon sensor's traffic to the CrowdStrike cloud
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team is deploying the Falcon sensor to a Kubernetes cluster using a Helm chart. After deployment, the sensor pods are running, but the team sees the following error in the logs: 'Failed to connect to CrowdStrike cloud: connection timed out'. The team has verified that the CID is correct and that the cluster has outbound internet access. What should the team check next?

   • AThe Kubernetes API server's availability
   • BThe sensor's service account permissions
   • CThe proxy configuration for the Falcon sensor
   • DThe sensor's resource limits
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is troubleshooting a Falcon sensor deployment in a Kubernetes cluster. The sensor pods are running, but the sensor is not reporting to the Falcon console. The team has verified the CID, proxy settings, and network connectivity. They also confirmed that the sensor is running in privileged mode. What should the team check next?

   • AThe kernel version of the nodes against the CrowdStrike support matrix
   • BThe number of replicas in the DaemonSet
   • CThe storage class used by the cluster
   • DThe Kubernetes version of the cluster
   Reveal Solution Discussion Select an answer first