What is the primary step required to deprovision a cloud account from Falcon in the CrowdStrike platform?

Question

Options

• ARemove all workloads and endpoints linked to the cloud account before attempting to deprovision
• BRevoke the API client credentials associated with the cloud account in the "API Clients and Keys"
• CDelete the cloud account directly from the cloud provider's console to automatically deprovision it
• DDisable the cloud account integration in the Falcon console under the "Cloud Accounts" tab.

• A
  4% (1)
• C
  8% (2)
• D
  88% (23)

Explanation

Option A: Although managing workloads and endpoints is a part of cloud security, their removal is not required for deprovisioning a cloud account in Falcon. This step is unnecessary and might lead to delays or errors in the deprovisioning process. Option B: Revoking API client credentials is an optional step for enhanced security but does not directly deprovision the cloud account from Falcon. Deprovisioning must still occur through the "Cloud Accounts" tab. Option C: Deleting the account from the cloud provider's console does not automatically deprovision it from Falcon. This action would leave stale configurations in the Falcon platform, potentially leading to unnecessary alerts or security concerns. Option D: Disabling the integration through the "Cloud Accounts" tab in the Falcon console is the correct way to deprovision a cloud account. This ensures that all configurations and permissions tied to the cloud account in the Falcon platform are properly removed. It also prevents further communication between Falcon and the cloud provider. Neglecting to do this may leave unnecessary configurations or cause alerts from unused integrations.

No community discussion yet for this question.