An organization is using CrowdStrike Falcon Runtime Protection to detect rogue containers and drift in their Kubernetes-based container infrastructure. Which scenario best represents an example of…

Question

Options

• AA developer manually pulls a new container image from a trusted registry and deploys it via Helm.
• BA container fails to start due to a misconfigured Kubernetes manifest file.
• CA running container deviates from its original image by spawning an unauthorized process or
• DAn application inside a container is updated using a rolling deployment strategy.

• A
  10% (7)
• B
  3% (2)
• C
  83% (57)
• D
  4% (3)

Explanation

Option A: Manually deploying a new container image does not indicate runtime drift unless it occurs in an unauthorized manner or introduces unexpected changes to a running container. Option B: A container failing to start due to a misconfiguration is a deployment issue, not an instance of runtime drift. Option C: Runtime drift occurs when a container's behavior deviates from its original image, such as spawning unauthorized processes, modifying system binaries, or introducing unexpected changes. This is a strong indicator of potential compromise or malicious activity. Option D: Rolling updates are a legitimate deployment strategy and do not indicate runtime drift unless they introduce unexpected changes outside of the intended update process.

No community discussion yet for this question.