What is the recommended action after CrowdStrike Falcon identifies a potentially malicious network connection in a containerized workload?

Question

Options

• AAutomatically restart the affected container to terminate the malicious connection.
• BRe-scan the container image used by the workload to identify vulnerabilities.
• CRely on cloud provider firewall logs to verify the nature of the connection.
• DBlock the container's network access and perform a forensic investigation of the workload.

• A
  2% (1)
• B
  5% (3)
• C
  9% (6)
• D
  85% (55)

Explanation

Option A: Restarting the container might temporarily stop the malicious connection, but it does not address the underlying cause or prevent recurrence. Option B: While re-scanning the image may identify vulnerabilities, it does not mitigate the immediate threat posed by the malicious connection. Option C: Cloud firewall logs may provide additional insights but are not sufficient to mitigate the threat or investigate the root cause effectively. Option D: Blocking network access prevents further malicious activity, while forensic investigation helps identify the root cause, such as exploited vulnerabilities or misconfigurations.

No community discussion yet for this question.