Which of the following describes the behavior of a runtime protection policy applied to containerized workloads in CrowdStrike Falcon?

Question

Options

• AMonitors and prevents known malicious activities in real-time within the container environment.
• BBlocks all system calls from container processes by default.
• CWorks only with specific container orchestration platforms like Kubernetes.
• DRequires manual signature updates to detect threats in the runtime environment.

• A
  92% (56)
• B
  2% (1)
• C
  2% (1)
• D
  5% (3)

Explanation

Option A: Runtime protection focuses on detecting and mitigating malicious activities, such as privilege escalation attempts or unauthorized network connections, in real-time. Option B: Blocking all system calls would render containers non-functional. Runtime protection policies are designed to monitor and selectively block only malicious or suspicious activities. Option C: Runtime protection policies are platform-agnostic and can protect containers regardless of the orchestration platform being used, including Kubernetes, Docker Swarm, or others. Option D: CrowdStrike Falcon uses a combination of signature-based and behavior-based detection techniques, with automatic updates to threat intelligence, removing the need for manual signature updates.

No community discussion yet for this question.