Which two configurations are necessary for successful deployment of the Falcon Container Sensor in Kubernetes? (Choose two)

Question

Options

• AAccess to Docker Hub
• BDaemonSet deployment configuration
• CCorrect namespace and permissions
• DManual agent token import

• A
  16% (8)
• B
  73% (36)
• D
  10% (5)

Explanation

Deploying the Falcon Container Sensor requires a DaemonSet (B) because it must run on every node in the cluster to provide complete runtime visibility - DaemonSets are the standard Kubernetes mechanism for node-level agents. Correct namespace and permissions (C) are equally essential: the sensor needs privileged access to the host's kernel and process space, which must be explicitly granted via RBAC roles and proper namespace placement.

A (Docker Hub access) is wrong because CrowdStrike distributes its container sensor through its own private registry, not Docker Hub. D (manual agent token import) is wrong because Falcon automates sensor authentication through its CID and API credentials configured in a Kubernetes secret - there is no manual token import step.

Memory tip: Think "DaemonSet + Permissions = Deployed Properly." DaemonSets ensure every node is covered, and permissions ensure the sensor can actually see what it needs to - without either, deployment fails.

No community discussion yet for this question.