Question 1

When should you enable Drift Prevention for containers?

AWhen containers are used for development and testing

BWhen images launch and need to download and install packages

CWhen your workloads have been designed to be immutable

DWhen deploying a brand new image
CrowdStrike recommends enabling Drift Prevention when container workloads have been designed to be immutable. Immutable infrastructure is a core cloud-native principle where containers are not modified after deployment. Any change to a running container---such as installing packages or modifying files---indicates potential misconfiguration or malicious activity.
Drift Prevention enforces this principle by blocking or alerting on runtime changes that deviate from the original container image. This makes it highly effective for production environments where containers should run exactly as built and deployed.
In development or testing environments, containers often change dynamically, making Drift Prevention impractical due to excessive false positives. Similarly, containers that must download or install packages at startup inherently require runtime modification and are not suitable candidates for Drift Prevention.
Enabling Drift Prevention at the wrong time can disrupt legitimate workloads. Therefore, CrowdStrike guidance clearly states that Drift Prevention should be enabled only after workloads are intentionally designed to be immutable, making option C the correct answer.

Answer : C

Question 2

You are reviewing Top IOMs and find that MFA for Azure has 62 findings indicating MFA has not been configured across all accounts.

Which options provide a more detailed investigation?

AIdentity & Cloud group

BEvent search & Asset graph

CCloudTrail logging & Application Registration
When investigating widespread Indicators of Misconfiguration (IOMs) such as Azure MFA not being enforced, CrowdStrike Falcon Cloud Security provides deeper investigative context through Event Search and Asset Graph. These two capabilities work together to move beyond a high-level finding count and into actionable insight.
Event Search allows analysts to query cloud control plane activity and identity-related events to understand how authentication policies are configured, modified, or bypassed over time. This helps determine whether MFA gaps are due to legacy configurations, recent changes, or specific identities or services.
Asset Graph provides a visual and relational view of cloud identities, subscriptions, roles, and permissions. It enables analysts to see which users, service principals, or resources are affected by missing MFA enforcement and how they are connected across the environment.
The other options do not provide the same depth of investigation. Identity & Cloud Group is primarily used for scoping visibility, while CloudTrail logging is AWS-specific and not applicable to Azure MFA findings. Therefore, the correct answer is Event search & Asset graph.

Answer : B

Question 3

When registering in AWS, what option is recommended to increase your security posture?

AReal-time visibility and detection

BApplication Security Posture Management

CAWS Control Center
When registering an AWS account with CrowdStrike Falcon Cloud Security, enabling real-time visibility and detection is recommended to improve overall security posture. This ensures continuous monitoring of cloud activity, identities, and resources rather than relying solely on periodic posture assessments.
Real-time detection allows Falcon to identify risky behavior, misconfigurations, and attack techniques as they occur, reducing dwell time and improving response effectiveness. The other options are not registration-specific security enhancements within Falcon.
Therefore, the correct answer is Real-time visibility and detection.

Answer : A

Question 4

You are investigating IOAs found in your cloud environment after a security breach. You must find any IOAs signifying that the threat actor has used techniques to maintain access to your cloud resources.

What filter on the IOA dashboard can you use to only view these specific IOAs?

AExecution

BPrivilege Escalation

CPersistence

DRansomware
In CrowdStrike Falcon Cloud Security, IOAs are categorized using MITRE ATT&CK-aligned tactics to help analysts quickly identify attacker objectives. When investigating how a threat actor may have maintained access to cloud resources after an initial breach, the appropriate tactic to focus on is Persistence.
Persistence IOAs represent techniques such as creating backdoor IAM roles, modifying access policies, adding API keys, enabling long-lived credentials, or altering cloud configurations to survive reboots or credential rotation. Filtering the IOA dashboard by Persistence isolates these behaviors, enabling faster root-cause analysis and remediation.
Other filters serve different investigative purposes. Execution focuses on initial code execution, Privilege Escalation highlights elevation of permissions, and Ransomware identifies encryption-related activity. None of these specifically address long-term access maintenance.
Therefore, filtering by Persistence is the correct and most effective way to identify IOAs related to maintaining access within cloud environments.

Answer : C

Question 5

Which Fusion workflow trigger can be used to take an action when a vulnerability is found on one of your container images?

AKubernetes and containers > Image assessment > Vulnerabilities

BKubernetes and containers > Container detections > Vulnerabilities

CVulnerabilities user action > Host

DVulnerabilities user action > Vulnerabilities
To automate response actions when a vulnerability is discovered in a container image, CrowdStrike Falcon Fusion uses the trigger Kubernetes and containers > Image assessment > Vulnerabilities. This trigger activates when Falcon identifies vulnerabilities during container image scanning and assessment.
Image assessment vulnerabilities occur pre-runtime, making this trigger ideal for shift-left security automation. Actions such as sending notifications, opening tickets, tagging images, or blocking deployments via policy enforcement can be automatically initiated before vulnerable images reach production.
The Container detections trigger applies to runtime events, not image vulnerabilities. Vulnerabilities user action triggers depend on manual interaction and are not suitable for automated detection-driven workflows.
By using the image assessment vulnerability trigger, organizations can integrate Falcon Cloud Security findings directly into CI/CD pipelines and remediation workflows, ensuring faster response and reduced risk exposure.
Therefore, the correct Fusion workflow trigger is Kubernetes and containers > Image assessment > Vulnerabilities.