Complete CCCS-203b CrowdStrike Materials

When registering an individual AWS account in CrowdStrike Falcon Cloud Security using the Falcon UI, therecommended and supported method is AWS CloudFormation. CrowdStrike provides a prebuilt CloudFormation template that automates the creation of required AWS resources, including IAM roles, permissions, and trust relationships needed for secure, read-only API access.

Using CloudFormation ensures the deployment isconsistent, auditable, and aligned with AWS best practices. It minimizes human error by automatically configuring the correct permissions required for Falcon to collect configuration, identity, and resource metadata from AWS. This method also simplifies lifecycle management—resources can be updated or removed cleanly by managing the CloudFormation stack.

Other options are not recommended for this use case.AWS Configis a native AWS compliance service but does not handle Falcon onboarding.Terraform scriptsmay be used in advanced or large-scale automation scenarios, but they are not the default or recommended approach for single-account registration in the Falcon UI.Bash scriptslack governance, validation, and repeatability.

Therefore, when registering a single AWS account through the Falcon console,AWS CloudFormationis the correct and CrowdStrike-recommended method.

WhenAWS Systems Manager (SSM)is unavailable,Ansibleis the supported and recommended IT automation tool for generating an inventory of unmanaged workloads and deploying the Falcon sensor using1-click sensor deployment workflows.

CrowdStrike integrates with Ansible to enable discovery, inventory generation, and automated sensor installation across cloud and on-prem environments. Ansible’s agentless architecture makes it especially suitable when native cloud management services are unavailable or restricted.

Other tools listed—Jet, Rudder, and Puppet—are not natively integrated with Falcon’s 1-click deployment workflows for unmanaged workload discovery in cloud environments.

Therefore,Ansibleis the correct answer.

To confirm whether malware exists within a container image, CrowdStrike Falcon Cloud Security directs investigators to reviewImage detection findings. These findings are generated during container image assessments, where Falcon performs deep inspection of image layers, binaries, and embedded artifacts.

Image detection findings include indicators of known malware, suspicious executables, malicious scripts, and other threats identified through CrowdStrike’s threat intelligence and detection engines. Because container images are often reused across environments, identifying malware at the image level is critical to preventing widespread propagation.

Other options do not directly confirm malware within an image.Drift indicatorsrelate to changes in a running container compared to its original image, not malware embedded in the image itself.Container alertsare typically runtime detections triggered by behavior during execution.Container misconfigurationsfocus on insecure settings rather than malicious code.

By reviewing image detection findings, security teams can identify infected images early, remediate by rebuilding clean images, and prevent deployment through policy enforcement mechanisms such as the Kubernetes Admission Controller. Therefore, the correct investigation path for suspected malware in a container image isImage detection findings.

When creating an Image Assessment policy exclusion in CrowdStrike Falcon Cloud Security, the recommended and most precise method to temporarily suppress a specific CVE isVulnerability ID & Exclude until 14 days.

This approach allows security teams to explicitly reference a known CVE (for example, CVE-2024-XXXX) and suppress enforcement for a defined time window. The 14-day exclusion period is commonly used to allow development teams time to rebuild images, validate patches, or address dependency constraints without permanently weakening security posture.

Broad exclusions based on recently published vulnerabilities or packages can unintentionally suppress unrelated risk and increase exposure. Indefinite exclusions are discouraged unless there is a strong, documented business justification.

CrowdStrike documentation and best practices emphasizetime-bound, CVE-specific exclusionsto balance operational flexibility with security rigor. Therefore, the correct and recommended option isVulnerability ID & Exclude until 14 days.