CrowdStrike CCCS flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared Responsibility Model

The provider secures the physical hosts, hypervisor, and managed-service internals; the customer secures identity, data, configuration, and the guest operating system. Managed services shift the boundary but never transfer customer accountability for data and access.

CSPM vs CWPP

CSPM evaluates control-plane configuration against benchmarks such as CIS. CWPP covers runtime and host-level posture. A finding surfaced by one does not imply the other is deployed or effective.

Control Plane vs Data Plane

Control-plane events are API calls that create, modify, or delete resources and appear in audit trails like CloudTrail management events. Data-plane events are object reads and writes, often not logged unless explicitly enabled.

Immutable Infrastructure Baseline

Instances are replaced rather than patched in place. Detection therefore baselines by image, AMI, or container digest, and treats any runtime drift from that approved digest as a signal.

Ephemeral Workload Telemetry

Container and serverless runtimes may live seconds. Telemetry must be streamed off-instance at creation because the artifact disappears with the workload, leaving nothing to collect afterward.

Management Account Isolation

The root or management account should hold only billing and organization controls. Workloads and log destinations live in member accounts so a single compromise cannot reach the whole estate.

Encryption Custody Question

Encryption posture is three separate decisions: at rest (customer-managed versus provider-managed key), in transit (termination point), and key custody (who can decrypt). Auditors ask which is customer-controlled.

Effective Permission Intersection

What a principal can do is the intersection of identity-based policy, resource-based policy, permissions boundary, and service control policy. No single document defines the effective permission set.

Explicit Deny Precedence

In AWS IAM evaluation, an explicit deny in any applicable policy overrides every allow, including an administrator allow. Deny is evaluated before allow across identity, resource, boundary, and SCP layers.

Cross-Account Trust Requirement

Cross-account access requires both sides to allow: the trusting account's role trust policy must name the principal, and the caller's own identity policy must permit the assume action.

PassRole Escalation Primitive

iam:PassRole combined with a compute creation action lets a principal attach a more privileged role to a new resource. It is a common privilege-escalation path and warrants alerting.

Static Access Key Risk

Long-lived access keys stored in code, environment variables, or images are a high-severity indicator. Roles with temporary STS credentials and workload identity federation are the preferred alternatives.

Unused Grant Evidence

Access advisor and last-accessed data older than the review window provide the evidence base for rightsizing a policy. Permission proliferation appears as grants with no recorded use.

Shared Service Account Problem

A credential used by many workloads makes attribution impossible during response. Service accounts and managed identities should be workload-scoped so activity maps to one application.

Runtime Sensor Coverage Gap

An instance or container without an agent produces configuration findings but no process-level telemetry. EDR detections cannot fire on it, so coverage percentage is the gating protection metric.

Container Protection Layers

Container protection combines image scanning before deployment, admission control that blocks non-compliant images, and runtime detection of process, file, and network behavior inside the container. All three are distinct controls.

Container Compromise Indicators

Signals include a shell spawned inside an application container, unexpected outbound connections, writes to read-only layers, crypto-mining process names, and privilege escalation through a mounted Docker socket.

Web Server Spawning Shell

A web server process such as nginx, httpd, or java spawning a shell or package manager is a high-fidelity Linux detection. The process ancestry is suspicious regardless of the payload involved.

File Integrity Monitoring Priorities

Baseline critical paths including passwd, shadow, SSH authorized_keys, and cron directories. Changes there are weighted far above application-directory churn when scoring an alert.

Serverless Protection Approach

Functions have no host to instrument. Protection depends on code and dependency scanning, review of function permissions, and auditing control-plane changes to deployment and configuration.

Vulnerability Exposure Ranking

Join vulnerability findings with internet reachability and compensating controls. A critical CVE on an exposed host outranks the same CVE on an isolated one with no external path.

Security Group vs NACL

Security groups are stateful and instance-level with allow rules only. Network ACLs are stateless and subnet-level, support allow and deny, and evaluate rules in order, so return traffic must be permitted explicitly.

VPC Flow Log Contents

Flow logs record metadata only: source and destination address and port, protocol, bytes, packets, action, and timestamps. They never contain payload, so they support traffic baselining rather than content inspection.

Flow Log Exfiltration Pivot

High byte counts from a single internal host to an external address, REJECT entries indicating scanning, and unusual destination ports suggesting command-and-control all warrant investigation in flow data.

Egress Control Gap

Default allow-all outbound rules permit command-and-control and data exfiltration. Restricting egress to known destinations through a proxy, policy NAT, or private endpoints is the mitigation.

Private Endpoint Visibility Loss

PrivateLink, VPC endpoints, and private peering remove traffic from the public internet, but they also remove it from internet-facing inspection tools. Visibility must be re-instrumented for those paths.

Public Exposure Findings

An internet-facing load balancer, a public bucket policy, or a security group open to 0.0.0.0/0 on a management port such as 22, 3389, or 3306 is a direct exposure finding.

DNS Query Logging Value

DNS logs reveal beaconing domains, DNS tunneling through long labels or high query volume to one domain, and resolution of newly registered domains that rarely appear in legitimate traffic.

Cloud Attack Sequence

Typical progression: credential discovery through identity API calls, privilege escalation, persistence via new access keys or role trust changes, then resource abuse such as crypto-mining or bulk data access.

Defense Evasion Signals

Watch for CloudTrail stopped or deleted, detection services disabled, log-bucket policies loosened, KMS keys scheduled for deletion, and activity in regions with no monitoring configured.

Cloud Isolation Procedure

Isolation is not unplugging a cable. Replace the security group with a deny-all forensic group, snapshot disks and memory, and preserve the instance rather than terminating it.

Credential Compromise Response Order

Revoke or deactivate keys, invalidate sessions, rotate role trust, then scope blast radius from CloudTrail. Do not delete the principal before collecting its activity history.

Forensic Evidence Preservation

Copy audit logs, flow logs, and snapshots to a separate write-protected forensic account with independent retention. Logs remaining in the compromised account are attacker-modifiable.

Compliance Evidence Mapping

Controls map to concrete artifacts: encryption to KMS key policies and config rules, access review to IAM credential reports, logging to trail configuration and retention settings. Frameworks include SOC 2, ISO 27001, PCI DSS, and CIS Benchmarks.