Free CCCS-203b Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Option A: Automatically disabling users without a thorough analysis could lead to operational

disruptions. CIEM performs a comprehensive assessment, considering factors like API activity, to ensure

accurate detection of inactivity.

Option B: Reassigning roles without first verifying the user’s purpose or activity may increase security

risks. CIEM focuses on identifying and managing inactive users, not on role reassignment as a default

action.

Option C: While CrowdStrike Falcon excels at endpoint detection and response (EDR), it is not designed

for analyzing cloud identity and access management (IAM) activities. Relying on Falcon for such tasks is

both inefficient and ineffective compared to using CIEM.

103/192

Option D: CIEM’s Identity Analyzer is specifically designed to monitor and analyze user activity

patterns across cloud environments. It can automatically detect inactive users based on their login, API

activity, and resource usage. This capability reduces the risk of overprivileged or orphaned accounts.

Using CIEM ensures efficiency and eliminates the manual overhead of user analysis.

Option A: Misconfigured Kubernetes ingress rules can expose sensitive services to the internet. The

correct action is to update Ingress and NetworkPolicy rules to limit access to only trusted sources and

necessary endpoints, reducing exposure while maintaining functionality.

Option B: Changing the container runtime (e.g., Docker to containerd) can have security benefits, but it

does not resolve misconfigured network exposure.

Option C: Shutting down pods immediately may prevent unauthorized access but could also cause

operational disruptions. The correct approach is to first secure network access before considering pod

restarts.

Option D: Disabling all public-facing networking is an extreme action that may impact legitimate

services. The issue should be addressed through precise network policy adjustments rather than blanket

restrictions.

Option A: Assessed/unassessed items relate to whether vulnerability assessment has occurred. This

choice incorrectly describes their scope and misapplies the terminology to accounts or containers instead

of container images.

Option B: Managed/unmanaged items do not refer to container images specifically. This conflates the

concept of container images (assessed/unassessed) with managed/unmanaged accounts or containers. The

status of being managed/unmanaged pertains to whether the item is actively monitored, not the

vulnerability state.

Option C: Managed items are accounts or containers actively integrated with and monitored by Falcon

Cloud Security. Unmanaged items are those outside the scope of Falcon monitoring, often requiring

additional steps to bring them under management. This distinction is fundamental to understanding

CrowdStrike’s coverage capabilities.

Option D: This explanation accurately describes assessed/unassessed items, not managed/unmanaged

items. The former pertains to whether a container image has been scanned for vulnerabilities.

Option A: CrowdStrike Falcon uses advanced AI-driven techniques, behavioral analytics, and real-time

threat intelligence rather than traditional signature-based detection, which is ineffective against modern

threats.

Option B: Falcon Cloud Security does not rely solely on application signing as a security measure.

Instead, it uses behavioral analysis, machine learning, and threat intelligence to detect and prevent threats.

Option C: While Falcon Cloud Security provides network monitoring and threat detection, it does not

automatically block all outbound traffic. Instead, it offers real-time visibility and response mechanisms

for cloud workloads.

Option D: CrowdStrike Falcon Cloud Security aligns with Zero Trust principles by continuously

monitoring cloud workloads, assessing risks, and enforcing least privilege access policies. It leverages

AI-powered threat detection, identity protection, and compliance automation to reduce risk.

Option A: Assessed items are those, such as container images, that have undergone vulnerability or

configuration assessments within Falcon Cloud Security. Unassessed items have not yet been scanned,

possibly due to configuration, scope, or timing limitations. Understanding this distinction is critical for

54/192

prioritizing security tasks.

Option B: The term "assessed" does not equate to being "fully patched." An item can be assessed and

still have vulnerabilities that need remediation.

Option C: Assessed and unassessed statuses are not related to the activity or archival state of containers.

Both active and inactive containers can be either assessed or unassessed depending on scanning

processes.

Option D: Assessed items are not synonymous with managed assets; unmanaged items can also be

assessed if scanned through external tools or workflows.

Option A: A one-size-fits-all approach ignores the unique requirements of different roles and leads to

over-permissioning or under-permissioning, both of which are undesirable from a security perspective.

Option B: Granting administrative privileges universally undermines security and increases the

likelihood of human error or exploitation. Only specific roles requiring administrative capabilities should

have such access.

Option C: Broad policies that grant universal access violate the principle of least privilege. They expose

the environment to unnecessary risks, such as unauthorized data access or resource modification.

Option D: This approach follows the principle of least privilege, ensuring users and roles have access

only to the resources and actions required for their responsibilities. This minimizes the attack surface,

reduces the risk of accidental or malicious misuse, and adheres to best practices in identity and access

management.

Option A: Using the CrowdStrike API to configure granular IAM policies is a potential task during or

after registration, but it is not the initial step. IAM roles and policies should be defined by the cloud

provider's configuration tools, not CrowdStrike, as a preliminary task.

Option B: Inputting cloud provider credentials directly into the CrowdStrike console is not a step in the

configuration process. Instead, API-based integrations rely on secure token-based authentication, not

direct username/password access, to align with best practices for security and scalability.

Option C: Assigning full administrator access to the CrowdStrike service account is unnecessary and

violates the principle of least privilege. Only specific permissions (e.g., read-only access for threat

detection) are required, and overly broad access increases the attack surface.

Option D: Generating an API client ID and secret is the required first step to enable secure

communication between the CrowdStrike Falcon platform and the cloud provider. The client ID and

secret are used for authentication when configuring API integrations, ensuring secure access to the cloud

account's data. Without this step, the integration cannot proceed.

5/192

Option A: Reassigning the Service Principal does not address the risk of overly permissive roles.

Additionally, using an existing Service Principal for a new purpose can create security challenges

Option B: While deleting the Service Principal may eliminate the risk, this approach can disrupt any

active dependencies. A more controlled remediation involves first reviewing and adjusting permissions.

Option C: Changing the role to "Reader" may reduce risk, but it does not address whether the Service

Principal is still necessary. The root cause (overly permissive roles and lack of usage) should be resolved.

Option D: The most effective action is to evaluate the necessity of the Service Principal and remove any

unnecessary roles or scopes. This minimizes risk while maintaining operational functionality if needed.

Option A: Configuring prevention settings like "Exploit Mitigation" and "Malware Prevention" is critical

to enhance security on servers. These settings help the Falcon Sensor proactively block threats and secure

the system.

Option B: The "Sensor Exclusions" tab is for excluding specific files, paths, or processes from

monitoring, not for creating or applying policies.

Option C: Assigning to the "Default Group" might lead to unintended policy application across non-

critical systems. Policies should target specific groups for better control.

Option D: While "Detection Only" provides visibility, it does not actively prevent threats. For critical

servers, enabling prevention is more appropriate to mitigate risks.

Option A: Falcon LogScale provides log analytics and can collect network event logs, but it does not

provide real-time visibility into active network connections at the process level. It is useful for post-

incident investigations but not for immediate runtime detection.

Option B: Identity Protection helps detect credential-based attacks and unauthorized access attempts but

does not monitor network connections at the process level. It is designed for preventing identity-based

56/192

threats rather than inspecting runtime network traffic.

Option C: This feature enables deep visibility into network connections at the process level within cloud

workloads, including Kubernetes containers. It allows the analyst to identify the specific containerized

process making the outbound connection, investigate its behavior, and detect potential threats.

Option D: Falcon Sandbox is used for analyzing suspicious files in an isolated environment to detect

malware behavior. It does not monitor active network connections within Kubernetes workloads.

Option A: Runtime security policies (e.g., limiting system calls with seccomp) help mitigate exploitation

risks but do not eliminate vulnerabilities. The CVEs could still be exploitable under certain conditions.

Option B: NetworkPolicies help restrict access to malicious actors but do not fix the vulnerabilities

within the image itself. The risk remains if an attacker finds another vector of exploitation.

Option C: Updating the base image to a patched version is the most effective way to eliminate

vulnerabilities before runtime. Modern container security best practices recommend using minimal and

frequently updated base images to reduce attack surfaces.

Option D: Whitelisting vulnerabilities is risky, as even if the application is not directly affected today,

future changes in dependencies or attack methods could expose the vulnerability.

Option A: Detection mode allows Falcon to monitor and alert on threats, but it does not create a direct

privilege escalation risk. While switching to prevention mode enhances security, the misconfiguration in

this scenario is related to IAM permissions rather than Falcon sensor settings.

Option B: Restricting SSH access to specific IPs is a best practice for minimizing exposure. While open

SSH access is a security risk, a properly restricted IP range does not directly contribute to privilege

escalation.

Option C: Granting AdministratorAccess to an EC2 instance profile is a critical security

misconfiguration. It allows any process running on the instance to assume unrestricted administrative

privileges, potentially leading to privilege escalation and lateral movement by an attacker. This is a high-

risk practice that should be avoided by implementing least privilege principles.

Option D: Enforcing MFA enhances security by requiring an additional authentication factor. While

MFA alone does not prevent all privilege escalation risks, it does not contribute to misconfiguration or

high-risk practices.

Option A: Scheduled reports must be configured with specific parameters such as data sources (cloud

assets, compliance findings, threat detections), reporting frequency (daily, weekly, monthly), and delivery

methods (email, dashboard, or external integrations).

Option B: While admin-level users can configure reports, role-based access control (RBAC) in

CrowdStrike allows specific roles, such as security analysts, to set up and receive reports without full

platform access.

Option C: Scheduled reports do not perform automatic mitigation; they provide insights and

recommendations, but security teams must take action based on the findings.

Option D: Scheduled reports are automated, meaning that once configured, they are generated

periodically without requiring manual execution.

Option A: Disabling logging and monitoring violates HIPAA compliance and makes it impossible to

detect security incidents. Cloud security requires continuous monitoring, audit logging, and alerting to

ensure compliance and threat mitigation.

Option B: Adaptive security rules using behavioral analytics and threat intelligence allow for proactive

threat detection and dynamic policy enforcement, ensuring both security and compliance. This method

74/192

prevents anomalies and unauthorized access without disrupting legitimate operations.

Option C: Default security group settings from cloud providers are often overly permissive. These must

be hardened with least privilege rules to prevent unauthorized access and data exposure.

Option D: An allow-all policy is a major security risk as it removes all access controls, making cloud

resources vulnerable to unauthorized access and potential data breaches, violating HIPAA compliance.

Option A: There is no requirement to link AWS and Azure for Falcon integration. Each cloud provider

has its own independent registration process.

Option B: Falcon sensors are not required for cloud account registration. Sensors provide endpoint

protection, whereas registration integrates Falcon with AWS APIs for monitoring.

Option C: CrowdStrike Falcon requires a properly configured IAM role with the necessary permissions

8/192

and a trust policy allowing Falcon to assume the role. If the trust relationship is not set up correctly,

Falcon cannot access the account to complete registration.

Option D: The IAM role is not assigned to a Lambda function but is instead created for Falcon to

assume. Registering a cloud account does not require Lambda integration.

Option A: Applying actual changes, even to a limited set of resources, does not constitute a dry run. A

dry run explicitly avoids making changes to validate the workflow without risk.

Option B: A dry run simulates the actions of the remediation workflow without actually making any

changes to the resources. This process is crucial for validating the workflow's logic, ensuring it targets the

6/192

intended findings, and understanding potential impacts. Dry runs help reduce the risk of unintended

disruptions in production environments.

Option C: A dry run does not bypass permissions validation. In fact, testing permissions is an important

part of the dry run process to ensure the workflow has the necessary access.

Option D: Generating compliance reports is not the purpose of a dry run. While useful for audits,

compliance reports do not test the logic or simulate the outcomes of a workflow.

72/192

Option A: Default Falcon registry settings may not cover all organizational needs. Custom configurations

should be made to ensure alignment with security policies.

Option B: Allowing all registries without authentication increases security risks, as unauthorized or

malicious images can be pulled and deployed.

Option C: To ensure pre-runtime protection, administrators should define registry connection details,

specify the registry URL, enable authentication (if needed), and set image scanning policies for security

compliance.

Option D: Private repositories are not automatically secure. Vulnerabilities can still exist in private

images, making it critical to enable scanning even for internal sources.

Option A: Deleting accounts without assessing their purpose could lead to operational disruptions,

especially if service accounts or critical roles are affected. CIEM focuses on remediation, not immediate

deletion.

Option B: Revoking all permissions is overly disruptive and impractical. Instead, permissions should be

adjusted based on the principle of least privilege to allow users to perform their roles securely.

Option C: CIEM emphasizes the principle of least privilege and the enforcement of MFA as core

security practices. Adjusting permissions to align with job roles and enabling MFA significantly reduces

the attack surface and prevents unauthorized access.

Option D: Transferring ownership does not address the underlying issue of excessive permissions or

missing MFA. It is a superficial action that leaves the security risks unresolved.

Option A: It is not necessary for all users in the cloud account to be enrolled in Falcon platform

authentication. Only the role or user performing the integration needs access.

Option B: Administrator-level access is not required and is considered a poor security practice.

CrowdStrike's design uses least-privilege access to minimize exposure.

Option C: To register a cloud account with CrowdStrike Falcon, a dedicated IAM role (for AWS) or

service principal (for Azure) must be configured with the appropriate permissions for CrowdStrike

integration. This ensures secure, granular access to the necessary resources for monitoring without over-

provisioning access rights.

Option D: Installing the Falcon agent on virtual machines is not a prerequisite for account registration.

The registration process focuses on cloud API integration, not individual agent deployment.

Option A: Monitoring does not address the root cause and leaves the system vulnerable to exploitation.

Prevention is better than detection in this context.

Option B: This approach may ensure a fresh start, but it is unnecessarily drastic and inefficient.

Upgrading the vulnerable package within the existing image is typically sufficient and more practical.

Option C: This is the recommended practice for addressing vulnerabilities. Updating the specific

package ensures the image is secure while maintaining functionality. Re-scanning verifies the

vulnerability is resolved.

Option D: Postponing mitigation can leave your systems exposed to security risks. Critical vulnerabilities

should be addressed immediately.