When CrowdStrike Falcon detects a suspicious outbound network connection from a runtime workload, what is the best immediate action to mitigate potential risks?

The correct answer is C. Quarantine the Affected Host. Option A: DNS filtering is a preventative measure that helps reduce exposure to known malicious domains but does not address active suspicious connections in a runtime environment. Option B: Generating a report is useful for documentation but does not provide an immediate mitigat

Cloud Workload Protection

Question

Options

AEnable DNS Filtering Across All Hosts
BGenerate an Incident Report for Future Review
CQuarantine the Affected Host
DManually Terminate the Suspected Network Connection

How the community answered

(67 responses)

A
1% (1)
B
6% (4)
C
82% (55)
D
10% (7)

Explanation

Option A: DNS filtering is a preventative measure that helps reduce exposure to known malicious domains but does not address active suspicious connections in a runtime environment. Option B: Generating a report is useful for documentation but does not provide an immediate mitigation strategy against ongoing threats. Option C: Quarantining the host is the most effective immediate response, as it isolates the workload to prevent further communication or lateral movement while the suspicious activity is investigated. CrowdStrike Falcon facilitates such actions to mitigate risks promptly. Option D: While terminating the connection might stop immediate communication, it does not address the root cause or prevent the host from initiating other malicious connections.

Topics

#runtime workload protection#suspicious network connection#host quarantine#incident response

Community Discussion

No community discussion yet for this question.

Full CCCS-203B Practice