サンプル問題 1： A company using CrowdStrike Falcon Cloud Security wants to ensure that all container images deployed in their cloud environment are scanned for vulnerabilities before deployment. Which image assessment policy should they implement?
A: Enforce pre-deployment scanning to block images with critical vulnerabilities from being deployed.
B: Allow all container images to be deployed, regardless of vulnerabilities, but notify administrators if an image contains high-severity vulnerabilities.
C: Only assess images manually when security teams request a scan.
D: Enable post-deployment scanning to assess vulnerabilities after an image has already been running in production.
正解：A
Explanation: Option A: Pre-deployment scanning with enforcement ensures that only secure images are deployed, blocking those with critical vulnerabilities. This helps mitigate security risks before they reach production. Option B: While notifying administrators about vulnerabilities is useful, allowing all images regardless of severity increases risk by deploying insecure workloads. Option C: Relying on manual assessments makes security processes inefficient and inconsistent, leading to gaps in protection. Option D: Post-deployment scanning is useful for continuous monitoring, but it does not prevent vulnerable images from being deployed in the first place.
サンプル問題 2： Which of the following best describes the process of identifying unassessed images in production using CrowdStrike Falcon?
A: Use the Falcon console to generate a report from the Image Assessment dashboard.
B: Deploy a custom script to parse container logs for unassessed image information.
C: Configure the runtime protection policy to block all unassessed images from running.
D: Enable auto-deletion of unassessed images directly from the Falcon console.
正解：A
Explanation: Option A: The Falcon console includes an Image Assessment dashboard that provides a comprehensive overview of container images in use, including identifying those that have not been scanned. This report helps teams address security gaps proactively. Option B: While custom scripts might extract relevant details, the Falcon console already provides built-in tools to identify unassessed images more efficiently and accurately. Option C: Runtime protection policies can prevent the execution of specific images based on policies, but they do not inherently identify or block all unassessed images automatically. Identification requires analysis via the Image Assessment dashboard. Option D: The Falcon console does not offer an auto-deletion feature for unassessed images. Actions related to unassessed images require manual intervention or automated workflows outside of Falcon.
サンプル問題 3： You are reviewing accounts using the CrowdStrike CIEM/Identity Analyzer and need to ensure MFA compliance. Which account configuration demonstrates proper MFA implementation?
A: An account with no login activity in the last 30 days and no additional authentication factors.
B: An account that uses password authentication and an authenticator app for a one-time password (OTP).
C: An account configured with biometric authentication only.
D: An account that allows users to bypass additional authentication steps on trusted devices.
正解：B
Explanation: Option A: The inactivity period and absence of additional authentication factors disqualify this account from demonstrating proper MFA implementation. This account would likely need further review for security compliance. Option B: This setup meets the definition of MFA, combining two factors: "something you know" (password) and "something you have" (authenticator app). This ensures robust security against unauthorized access. Option C: While biometric authentication ("something you are") is a strong factor, MFA requires combining at least two different factors. Biometric authentication alone does not meet this standard. Option D: Allowing bypass of additional steps compromises the integrity of MFA and introduces vulnerabilities. Proper MFA should always require multiple factors, even on trusted devices.
