A cloud security team is responsible for configuring CrowdStrike Falcon runtime sensor policies to secure their organization's serverless and containerized workloads. The goal is to prevent unauthoriz

Question

Options

• ADisable least privilege enforcement to prevent false positives and allow all network traffic
• BEnable least privilege enforcement, network anomaly detection, and allowlisting of trusted
• CDisable application allowlisting and only rely on default cloud provider security controls
• DEnable unrestricted execution of serverless functions while monitoring for network anomalies

• A
  14% (5)
• B
  51% (19)
• C
  27% (10)
• D
  8% (3)

Explanation

Option A: Disabling least privilege enforcement significantly increases the risk of privilege escalation attacks. Additionally, allowing all network traffic can expose workloads to lateral movement attacks. Option B: This approach minimizes the attack surface by ensuring workloads operate with the least privileges required, detects suspicious network activity, and prevents unauthorized applications from executing. It provides a strong security posture while maintaining business Option C: Cloud provider security controls offer a baseline of protection, but disabling application allowlisting removes the ability to control which applications can execute, increasing the risk of unauthorized software running in the environment. Option D: While monitoring network anomalies is valuable, unrestricted execution of serverless functions can lead to unauthorized execution of malicious code, increasing the risk of security

No community discussion yet for this question.