Question 1

When using the Identity Analyzer feature in CrowdStrike CIEM to identify inactive users, which data source is primarily used to assess inactivity?

Options :

A : Audit trails of API calls and resource utilization.

B : Historical security alerts from CrowdStrike Falcon.

C : Network traffic logs from connected endpoints.

D : CrowdStrike Falcon sensor telemetry.

Answer: A

Question 2

What is the primary purpose of creating Falcon Cloud Security Policies and Rules in a cloud environment?

Options :

A : To configure network ingress and egress rules for cloud-native firewalls.

B : To enforce granular security controls for workloads, users, and cloud resources based on predefined conditions.

C : To manage the deployment of Falcon agents across virtual machines.

D : To automate software updates for containerized applications in the cloud.

Answer: B

Question 3

Which step is essential when registering a cloud account in Falcon Cloud Security?

Options :

A : Enabling API access and permissions to allow CrowdStrike to monitor the account.

B : Deploying the Falcon agent on all instances in the account before registration.

C : Configuring automatic backup settings for all cloud resources.

D : Configuring network firewalls to route all traffic through CrowdStrike-s servers.

Answer: A

Question 4

Your organization uses AWS, and you are tasked with configuring an automated remediation workflow in Falcon Fusion to respond to findings about unencrypted S3 buckets. What is the critical action you must configure in the workflow to remediate such findings?

Options :

A : Set the S3 bucket policy to enforce encryption.

B : Delete all objects in the unencrypted S3 bucket.

C : Trigger an email notification to the security team.

D : Generate a compliance report for the unencrypted bucket.

Answer: A

Question 5

What is the recommended action after CrowdStrike Falcon identifies a potentially malicious network connection in a containerized workload?

Options :

A : Rely on cloud provider firewall logs to verify the nature of the connection.

B : Re-scan the container image used by the workload to identify vulnerabilities.

C : Automatically restart the affected container to terminate the malicious connection.

D : Block the container-s network access and perform a forensic investigation of the workload.

Answer: D