A cloud security engineer is responsible for ensuring that all cloud workloads remain secure from vulnerabilities before execution. The engineer wants to use CrowdStrike Falcon's pre-runtime…

Question

Options

• AUse a container image registry with basic signature verification but without vulnerability scanning
• BEnable Falcon Spotlight and configure real-time vulnerability scanning for installed packages
• CManually check for CVEs using open-source vulnerability databases and apply patches reactively
• DDisable vulnerability scanning and rely only on cloud provider security controls

• A
  2% (1)
• B
  76% (34)
• C
  13% (6)
• D
  9% (4)

Explanation

Option A: Signature verification ensures the integrity of container images but does not detect vulnerabilities in installed packages. Without scanning, vulnerabilities in software dependencies may go undetected. Option B: Falcon Spotlight provides real-time vulnerability management, detecting security issues in installed packages before runtime. This allows proactive remediation, reducing the attack surface before an exploit can occur. Option C: Manually checking CVE databases is inefficient and does not provide real-time detection. This reactive approach increases the risk of running vulnerable workloads before security teams can apply patches. Option D: While cloud provider security controls offer some baseline protections, they do not provide comprehensive pre-runtime scanning for vulnerabilities in installed packages. A dedicated vulnerability management solution is required.

No community discussion yet for this question.