Cloud Workload Protection and Response Operations
Domain 4: Cloud Workload Protection and Response Operations
This domain tests runtime protection and incident response for cloud workloads: VMs, containers, Kubernetes, and serverless where supported. Questions ask you to choose telemetry, contain scope, preserve evidence, and avoid destroying cloud context.
Core rules
- The Falcon sensor provides process, file, network, and user telemetry on supported hosts and containers, enabling IOA detection, malware prevention, and response actions such as isolating a host, killing a process, quarantining a file, or running response scripts.
- Cloud context matters: map a detection to instance ID, account, VPC, image, pod, service account, and IAM role. A host alert without identity context is incomplete.
- Containment differs by workload. Isolating a VM may stop lateral movement but can break service. For Kubernetes, consider quarantining the pod, cordoning the node, and checking admission policy; deleting the pod may erase evidence.
- Preserve evidence before destructive action: snapshot disks where policy allows, capture process trees, network connections, and cloud audit logs, and record image digests.
- After credential exposure, rotate keys and revoke sessions; stopping the process alone leaves valid credentials.
- Response is iterative: triage, scope, contain, eradicate, recover, and verify. Use cloud logs and asset inventory to find sibling workloads from the same image or role.
Worked example
A Linux VM runs a cryptocurrency miner. Falcon reports an IOA for a suspicious process spawned from a web service, with outbound connections to a mining pool. The instance role can read backups. Reasoning: this is runtime behavior, not just a vulnerable package. Isolate the host or block the process, capture a snapshot and process tree, revoke the instance role sessions, rotate exposed secrets, then rebuild from a clean image. Check other instances using the same image and role. Do not merely terminate the VM before evidence and credential rotation.
Traps
- Relying on agentless snapshots for real-time prevention.
- Deleting a compromised pod or VM before collecting evidence.
- Containing one host without checking shared image, role, or service account.
- Forgetting control-plane logs and identity sessions.
- Treating a vulnerability finding as proof of exploitation.