A security team using CrowdStrike Falcon Runtime Protection wants to detect and respond to Indicators of Attack (IOAs) in their containerized environment. Which of the following is the best approach…

Question

Options

• AMonitor system calls and process behaviors in runtime to detect anomalous activity indicative of an
• BBlock all incoming network connections to containerized workloads to prevent potential attacks.
• COnly analyze static container images for known vulnerabilities before deployment.
• DRely exclusively on Kubernetes audit logs to identify threats within the environment.

• A
  71% (27)
• B
  3% (1)
• C
  11% (4)
• D
  16% (6)

Explanation

Option A: CrowdStrike Falcon Runtime Protection detects Indicators of Attack (IOAs) by monitoring system calls, process behaviors, and runtime activities in containers. This allows Falcon to identify anomalous activity, privilege escalation attempts, and suspicious behaviors indicative of an attack. Option B: Blocking all network traffic would break legitimate communications and is not a practical security measure. Instead, Falcon applies behavioral analytics to detect suspicious network activity dynamically. Option C: Static analysis alone is insufficient for detecting IOAs, as runtime threats may emerge after deployment, including zero-day attacks and living-off-the-land techniques. Option D: While Kubernetes audit logs provide useful insights, they do not capture all IOAs, particularly those at the process and system call level within containers.

No community discussion yet for this question.