Option A: While administrators might use PowerShell for automation, it's uncommon to encode commands in base64 unless there's a specific need to obfuscate. This could indicate suspicious activity. Additional context, like logs or administrator intent, is required to confirm this as legitimate.
Option B: This behavior is highly indicative of malicious activity. PowerShell, especially when invoked with encoded commands, is a common vector used by attackers for credential dumping or executing malicious scripts. Reviewing the command and decoding the base64 string is essential to determine the exact purpose of the script. You should isolate the system and conduct further analysis to confirm and mitigate the threat.
Option C: Software updates rarely require PowerShell scripts with encoded commands.
Confirming this scenario would require verifying the activity against scheduled update logs or communication from the IT team.
Option D: System errors can lead to unexpected behavior, but they are unlikely to involve encoded commands passed to powershell.exe. Such activity should be treated as suspicious until proven otherwise.

CrowdStrike recommends enablingDrift Preventionwhen container workloads have beendesigned to be immutable. Immutable infrastructure is a core cloud-native principle where containers are not modified after deployment. Any change to a running container-such as installing packages or modifying files-indicates potential misconfiguration or malicious activity.
Drift Prevention enforces this principle by blocking or alerting on runtime changes that deviate from the original container image. This makes it highly effective for production environments where containers should run exactly as built and deployed.
In development or testing environments, containers often change dynamically, making Drift Prevention impractical due to excessive false positives. Similarly, containers that must download or install packages at startup inherently require runtime modification and are not suitable candidates for Drift Prevention.
Enabling Drift Prevention at the wrong time can disrupt legitimate workloads. Therefore, CrowdStrike guidance clearly states that Drift Prevention should be enabledonly after workloads are intentionally designed to be immutable, making optionCthe correct answer.

Visibility intoAWS IAM controls, includingrestricted use of AWS CloudShell (CIS IAM 1.20), is provided throughCrowdStrike Falcon Cloud Security posture managementusingIndicators of Misconfiguration (IOMs). These checks continuously evaluate cloud resources againstindustry-standard benchmarks, including theCIS Foundations Benchmarks for AWS, Azure, and Google Cloud.
CrowdStrike maintainsprebuilt, managed IOM policiesthat are automatically updated to reflect the latest CIS guidance. Leveraging existing IOM policies ensures immediate coverage without the operational risk or overhead of creating and maintaining custom rules. These policies assess IAM configurations, permissions usage, service access controls, and policy enforcement related to CloudShell usage.
IOAs are designed for runtime behavioral detections and are not suitable for posture or configuration validation. Creating custom IOMs is unnecessary for CIS-aligned controls because CrowdStrike already provides validated, benchmark-mapped policies maintained by CrowdStrike security research.
Therefore,leveraging existing IOM policiesis the correct and recommended approach to maintain continuous, benchmark-aligned visibilityacross multi-cloud environments.

Option A: Deleting the connection immediately disrupts ongoing workflows and may result in failed image assessments or deployments.
Option B: Editing the existing connection details and saving changes is the best approach, as Falcon Cloud Security allows modifications to registry connections with minimal impact. Testing ensures the changes are valid before they take effect.
Option C: Disabling workloads is unnecessary unless the changes involve critical configurations affecting runtime operations.
Option D: Resetting Falcon Cloud Security settings is excessive and risks losing unrelated configurations, introducing unnecessary complications.

Option A: This is incorrect because the Falcon sensor focuses on runtime protection and process monitoring. Vulnerability scanning is a separate feature, often provided by CrowdStrike's Cloud Security module or other integrated tools.
Option B: The Falcon sensor offers robust runtime protection, which includes monitoring processes and detecting potentially malicious activities inside both the host and containers. This functionality helps identify threats in real-time, making it a critical component of securing Kubernetes workloads.
Option C: This is incorrect as RBAC policies remain a fundamental part of Kubernetes security.
The Falcon sensor complements, but does not replace, Kubernetes native security configurations like RBAC.
Option D: While the Falcon sensor provides process and file activity monitoring, it does not perform deep packet inspection for network traffic. This would require a separate network security solution.