Prepare Smarter for the CCCS-203b Exam

In CrowdStrike Falcon Cloud Security, Cloud Groups can be applied to container images using three specific image attributes: Image registry, Image repository, and Image tag. These attributes uniquely identify container images and allow precise scoping of policies and visibility.

Image registry identifies where the image is hosted (for example, Amazon ECR or Docker Hub).

Image repository defines the namespace or project within that registry.

Image tag specifies the version or variant of the image.

Together, these attributes provide a consistent and cloud-native method to group images across environments. Other attributes such as image version or type are not used as Cloud Group selectors in Falcon. Therefore, the correct answer is Image registry, Image repository, and Image tag.

CrowdStrike Falcon Cloud Security performs agentless cloud security posture management (CSPM) by integrating directly with cloud service providers such as AWS, Microsoft Azure, and Google Cloud Platform using native APIs. This approach allows Falcon to continuously assess cloud configurations, permissions, networking, storage, and identity controls without deploying sensors or agents.

By default, CrowdStrike configures cloud account scans to run every 4 hours . This scan frequency is designed to strike a balance between near-real-time visibility and efficient API usage across cloud providers. Cloud environments are highly dynamic, with frequent changes to configurations, IAM policies, and services. A four-hour scan interval ensures that new misconfigurations or risky changes—such as overly permissive roles, exposed storage, or insecure network rules—are identified quickly enough to reduce exposure time

Scanning more frequently could introduce unnecessary API throttling or operational overhead, while less frequent scans could delay detection of critical security gaps. The four-hour interval is therefore CrowdStrike’s recommended default for maintaining continuous visibility while preserving cloud provider performance and stability.

This default interval can be adjusted in certain scenarios, but unless explicitly changed, every 4 hours is the standard scan cadence applied to AWS, Azure, and GCP environments.

In CrowdStrike Falcon Cloud Security , IOAs are categorized using MITRE ATT & CK-aligned tactics to help analysts quickly identify attacker objectives. When investigating how a threat actor may have maintained access to cloud resources after an initial breach, the appropriate tactic to focus on is Persistence .

Persistence IOAs represent techniques such as creating backdoor IAM roles, modifying access policies, adding API keys, enabling long-lived credentials, or altering cloud configurations to survive reboots or credential rotation. Filtering the IOA dashboard by Persistence isolates these behaviors, enabling faster root-cause analysis and remediation.

Other filters serve different investigative purposes. Execution focuses on initial code execution, Privilege Escalation highlights elevation of permissions, and Ransomware identifies encryption-related activity. None of these specifically address long-term access maintenance.

Therefore, filtering by Persistence is the correct and most effective way to identify IOAs related to maintaining access within cloud environments.

To secure an AWS Elastic Kubernetes Service (EKS) cluster running on Amazon Linux 2–based EC2 instances with container-level visibility , CrowdStrike Falcon documentation identifies the Falcon Container Sensor for Linux as the correct solution. This sensor is part of Falcon Cloud Security and is purpose-built to protect Kubernetes and containerized workloads.

The Falcon Container Sensor for Linux is deployed as a container (commonly as a DaemonSet) on each Kubernetes worker node. It integrates with the underlying Linux kernel to observe container runtime activity while maintaining Kubernetes awareness. This allows CrowdStrike to deliver deep visibility into container processes, file system activity, network connections, and inter-container behavior—capabilities that are not available with host-only sensors.

The Falcon Sensor for Linux protects the EC2 host operating system but does not provide container-aware telemetry or Kubernetes context. The Falcon Kubernetes Admission Controller is a pre-runtime control used to enforce image and deployment policies at admission time, not to provide runtime detection. Image Assessment at Runtime is a feature for evaluating container images and is not a deployable sensor.

Because the requirement explicitly includes runtime protection and container-level visibility within EKS , the Falcon Container Sensor for Linux is the only option that fully satisfies these needs according to CrowdStrike Falcon Cloud Security architecture and documentation.

CrowdStrike Falcon Cloud Security strongly recommends shifting security left in the development lifecycle by integrating image assessment directly into the CI/CD pipeline . This approach ensures vulnerabilities are detected during the build process , before images are deployed into production environments.

By pushing container images to Falcon for assessment as part of CI/CD workflows, Falcon expands image layers, inventories binaries and OS packages, and evaluates vulnerabilities early. This enables development and security teams to remediate issues before deployment, reducing risk exposure and preventing vulnerable images from ever reaching runtime.

Runtime-only analysis and host-based tools are insufficient for proactive security, as they detect issues after exposure has already occurred. Manual inspection does not scale and introduces human error, making it unsuitable for modern DevOps pipelines.

Therefore, integrating automated image assessment into CI/CD pipelines is the CrowdStrike best practice for secure container deployments.