An organization wants to create a custom Indicator of Misbehavior (IOM) rule in Falcon Cloud Security to detect and alert when a container attempts to write to a restricted file system directory…

Question

Options

• AUse AWS IAM policies to block write attempts to the /etc/passwd file.
• BCreate the custom IOM rule in the Falcon Cloud Security Console under the "IOM Rules" section.
• CDefine the rule in the Kubernetes Admission Controller manifest.
• DModify the default Falcon Container Sensor YAML file.

• A
  7% (2)
• B
  72% (21)
• C
  3% (1)
• D
  17% (5)

Explanation

Option A: AWS IAM policies manage access permissions for AWS resources but cannot monitor or prevent runtime file system access in containers. Option B: Falcon Cloud Security provides a dedicated section for creating and managing custom IOM rules. This is the appropriate place to define rules for detecting specific misbehavior, such as unauthorized file system writes. Option C: Kubernetes Admission Controller policies are used for validating or mutating objects during deployment, not for runtime threat detection like monitoring file system activity. Option D: The Falcon Container Sensor YAML file is used to deploy the sensor itself and cannot be modified to create custom IOM rules.

No community discussion yet for this question.