Falcon Cloud Security Visibility and Assessment
Domain 3: Falcon Cloud Security Visibility and Assessment
This domain tests how you use Falcon Cloud Security to inventory cloud assets, assess posture, evaluate identity risk, and prioritize findings. Expect questions that distinguish posture assessment from runtime protection and that ask which evidence supports a conclusion.
Core rules
- CSPM evaluates cloud configuration against benchmarks and policies; it surfaces indicators of misconfiguration such as public storage, open security groups, disabled logging, and unencrypted resources.
- CIEM evaluates effective permissions and unused or excessive access; it helps identify roles that can reach sensitive data or escalate privileges.
- Agentless assessment uses provider APIs and snapshots to find vulnerabilities, packages, secrets, and malware without a sensor on every workload. It is broad and periodic, not a real-time blocking control.
- Agent-based protection uses the Falcon sensor for runtime telemetry, IOAs, and response actions on supported workloads.
- Kubernetes and IaC assessment shift checks earlier: IaC scans catch issues before deployment; admission control can block noncompliant workloads.
- Findings need context: internet exposure, sensitive data, identity reachability, and attack path raise severity. A low-severity misconfiguration on an exposed, privileged asset may outrank a high-severity issue on an isolated test host.
Worked example
A CSPM scan finds an S3 bucket with public ACLs. CIEM shows an attached role can read a secrets store. Agentless scanning finds an outdated package on an EC2 instance. Reasoning: the public bucket is exposure; the role is privilege; together they suggest a path from public data to secrets. The package finding matters if the instance is reachable and running the vulnerable service. Prioritize blocking public access and reducing the role first, then patch based on exposure. Do not call the package finding an active compromise; that requires runtime or log evidence.
Traps
- Treating CSPM as runtime detection or blocking.
- Assuming agentless scanning gives continuous process-level visibility.
- Ranking findings by severity label alone without exposure and identity context.
- Forgetting registration scope, so accounts or projects are uninventoried.
- Confusing a misconfiguration indicator with an indicator of attack.