CrowdStrike CCCS-203b Exam - Topic 5 Question 2 Discussion

Actual exam question for CrowdStrike's CCCS-203b exam

Question #: 2
Topic #: 5

You receive an alert that one of your container images contains AWS credentials stored in cleartext.

What detection type should you search for to investigate?

ASuspicious file

BMisconfiguration

CExposed credential

DSecret
When CrowdStrike Falcon detects cloud credentials---such as AWS access keys---stored in cleartext within a container image, the finding is classified as a Secret detection. Secrets include sensitive data such as API keys, access tokens, passwords, and cryptographic material embedded in container images, configuration files, or source code.
Falcon Cloud Security performs deep inspection of container images during image assessment to identify hard-coded secrets before those images are deployed into runtime environments. Storing AWS credentials in cleartext represents a critical security risk because attackers who gain access to the image can easily extract and misuse those credentials to access cloud resources.
While misconfigurations focus on insecure cloud settings and suspicious files relate to potentially malicious artifacts, secret detections are specifically intended to highlight exposed sensitive information. The Exposed credential option may sound similar, but within CrowdStrike's detection taxonomy for container and image security, these findings are categorized under Secret detections.
Investigating Secret detections allows security teams to quickly identify where credentials are embedded, rotate compromised keys, and remediate the issue by using secure alternatives such as cloud-native secrets managers or environment-based injection mechanisms. Therefore, the correct detection type to search for is Secret.

Show Suggested Answer

Suggested Answer: D

by Erick at Jan 22, 2026, 04:50 PM

Limited Time Offer

25%

Off

Get Premium CCCS-203b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Arthur

4 days ago

Definitely a Secret detection!

upvoted 0 times

...

James

9 days ago

Ah, the age-old battle between secrets and credentials. I'll take the "Secret" option, please!

upvoted 0 times

...

Elenora

14 days ago

D) Secret is the answer, no doubt. Gotta keep those AWS keys under lock and key!

upvoted 0 times

...

Melodie

20 days ago

Secrets, huh? Sounds like a job for the secret agent of the security team!

upvoted 0 times

...

Kenneth

25 days ago

Hmm, I thought it would be B) Misconfiguration. Guess I need to brush up on my cloud security knowledge.

upvoted 0 times

...

Clay

30 days ago

C) Exposed credential is the way to go!

upvoted 0 times

...

Mabel

1 month ago

I feel like misconfigurations could also be relevant, but they usually relate to settings rather than actual credentials in cleartext.

upvoted 0 times

...

Erin

1 month ago

I practiced a question about detecting hard-coded secrets before, and I think it was classified under Secret as well.

upvoted 0 times

...

Luisa

2 months ago

I'm not entirely sure, but I remember something about exposed credentials being a risk too. Isn't that similar to what we're looking for?

upvoted 0 times

...

Benedict

2 months ago

I think the right answer is D) Secret, since it specifically deals with sensitive information like AWS credentials.

upvoted 0 times

...

Gail

2 months ago

The explanation makes sense to me. "Secret" detections are specifically for exposed sensitive information like credentials, which is exactly what the question is asking about. I'm confident that's the right answer.

upvoted 0 times

...

Eun

3 months ago

I'm a bit confused on the differences between the detection types here. Is "Misconfiguration" the same as "Secret"? I'll have to review the explanations more closely.

upvoted 0 times

...

Clay

3 months ago

Okay, let me see if I've got this right. When Falcon detects AWS credentials in cleartext in a container image, that's classified as a "Secret" detection, not an "Exposed credential" detection. I think I understand now.

upvoted 0 times

...

Iluminada

3 months ago

Hmm, I'm a little unsure about this one. Is "Exposed credential" the same as "Secret"? I'll need to think this through carefully.

upvoted 0 times

...

Martin

3 months ago

This seems like a pretty straightforward question. The key is to identify the detection type that specifically deals with exposed credentials, which in this case is "Secret".

upvoted 0 times

...