A security administrator at a company using CrowdStrike Falcon in a multi-cloud environment needs to configure runtime sensor policies to ensure optimal security while maintaining operational…

Question

Options

• ADisable process blocking but enable container runtime security
• BEnable only file integrity monitoring and allow all processes by default
• CDisable process blocking, file integrity monitoring, and container runtime security for minimal
• DEnable process blocking, enable file integrity monitoring, and enforce container security policies

• A
  24% (8)
• B
  3% (1)
• C
  12% (4)
• D
  61% (20)

Explanation

Option A: Enabling container security without process blocking may still allow unauthorized processes to execute, potentially leading to container escapes or privilege escalation attacks. Process blocking is essential for preventing unauthorized execution. Option B: While file integrity monitoring is crucial, allowing all processes by default increases the attack surface and enables unauthorized execution of malicious scripts or binaries. A proper runtime sensor policy should also include process blocking. Option C: This option prioritizes system performance at the cost of security, making the system highly vulnerable to runtime threats such as unauthorized code execution and data exfiltration. Option D: This configuration provides a balanced approach to security, ensuring unauthorized processes are blocked, file integrity is monitored for changes that could indicate tampering, and container security policies are enforced to mitigate container runtime threats. This setup aligns with best practices for runtime security in cloud environments.

No community discussion yet for this question.