Question 1

You want to customize the GKE autopilot policy by updating the detection severity (Critical) and the detection type (CIS benchmark deviation) along with Vulnerability ExPRT.ai severities (Critical).

Which combination will trigger the prevention?

A. Vulnerability ExPRT.ai severities (Critical), Detection severity (Critical)
B. Vulnerability ExPRT.ai severities (Critical), Detection severity (Critical), Image misconfigurations
C. Vulnerability ExPRT.ai severities (Critical), Detection severity (Critical), Detection type (CIS benchmark deviation) In Falcon Cloud Security, prevention actions are triggered when all configured enforcement criteria within a policy are met. When customizing the GKE Autopilot policy, enforcement requires alignment across vulnerability intelligence, detection severity, and compliance context. By setting: Vulnerability ExPRT.ai severity = Critical Detection severity = Critical Detection type = CIS benchmark deviation you ensure that both risk-based vulnerability intelligence and compliance deviation severity thresholds are satisfied. This combination confirms that the issue is not only severe but also represents a critical deviation from an accepted security benchmark, justifying prevention. Omitting the detection type or replacing it with image misconfiguration alone does not meet the enforcement logic required for policy-triggered prevention. Therefore, Option C is the correct combination that triggers prevention.

Question 2

You are troubleshooting an issue with an Azure account registered in Falcon Cloud Security. The registration appeared to be successful, but certain CSPM operations---including asset inventories and IOM detection---are failing.

How can you securely test the hypothesis that these failed CSPM operations are related to your firewall configuration?

A. Check that you have allowlisted the IP addresses provided in the public-facing CrowdStrike documentation
B. Begin investigating another hypothesis as there is no way blocked traffic could be responsible
C. Temporarily open up the firewall to all inbound traffic for testing purposes The secure and recommended way to test whether firewall restrictions are causing CSPM operation failures is to verify that the required CrowdStrike IP addresses are allowlisted. Falcon Cloud Security relies on outbound API communication between CrowdStrike and the cloud provider. If firewall rules block this traffic, asset inventory collection and IOM detection can fail even though registration appears successful. CrowdStrike publishes a list of IP addresses and endpoints that must be permitted for proper operation. Validating firewall allowlists against this documentation is a low-risk, best-practice troubleshooting step that preserves security controls while testing connectivity assumptions. Temporarily opening firewalls to all inbound traffic is insecure and strongly discouraged. Dismissing firewall-related causes without validation can delay resolution. Therefore, the correct and secure approach is to check that the CrowdStrike IP addresses are allowlisted.

Latest CrowdStrike CCCS-203b Practice Questions BY Richards

Other Popular CrowdStrike Exams