CrowdStrike CCCS-203b Exam - Topic 4 Question 14 Discussion

Question

You want to block privileged containers from being executed in your Kubernetes cluster.What sensor type should you deploy?

Glen · Accepted Answer

D) Kubernetes Admission Controller
To block privileged containers before they are executed, CrowdStrike recommends deploying the Kubernetes Admission Controller. This component operates at admission time, intercepting Kubernetes API requests and enforcing security policies before workloads are allowed to run.
Privileged containers represent a significant security risk because they can bypass isolation boundaries and access host resources. The Kubernetes Admission Controller can enforce policies that explicitly deny deployments using privileged flags, hostPath mounts, or other high-risk configurations.
Other options do not provide enforcement. Runtime sensors and agents can detect or alert on risky behavior after execution, but they cannot prevent the workload from starting. Image assessment evaluates image content but does not enforce Kubernetes runtime constraints.
Therefore, to proactively block privileged containers, the correct and CrowdStrike-recommended solution is the Kubernetes Admission Controller.

Glen · Answer

A) Kubernetes Protection Agent

Glen · Answer

B) Kubernetes Sensor

Glen · Answer

C) Kubernetes Image Assessment at Runtime