CrowdStrike CCCS-203b Exam - Topic 6 Question 1 Discussion

Actual exam question for CrowdStrike's CCCS-203b exam

Question #: 1
Topic #: 6

What is needed to achieve visibility into the latest AWS IAM 1020 restricted use of AWS CloudShell with the latest CIS Foundations Benchmarks for AWS, Azure, and Google Cloud?

ALeverage existing IOA policy

BCreate custom IOA policy

CCreate custom IOM policy

DLeverage existing IOM policy
Visibility into AWS IAM controls, including restricted use of AWS CloudShell (CIS IAM 1.20), is provided through CrowdStrike Falcon Cloud Security posture management using Indicators of Misconfiguration (IOMs). These checks continuously evaluate cloud resources against industry-standard benchmarks, including the CIS Foundations Benchmarks for AWS, Azure, and Google Cloud.
CrowdStrike maintains prebuilt, managed IOM policies that are automatically updated to reflect the latest CIS guidance. Leveraging existing IOM policies ensures immediate coverage without the operational risk or overhead of creating and maintaining custom rules. These policies assess IAM configurations, permissions usage, service access controls, and policy enforcement related to CloudShell usage.
IOAs are designed for runtime behavioral detections and are not suitable for posture or configuration validation. Creating custom IOMs is unnecessary for CIS-aligned controls because CrowdStrike already provides validated, benchmark-mapped policies maintained by CrowdStrike security research.
Therefore, leveraging existing IOM policies is the correct and recommended approach to maintain continuous, benchmark-aligned visibility across multi-cloud environments.

Show Suggested Answer

Suggested Answer: D

by Mattie at Jan 23, 2026, 10:06 AM

Limited Time Offer

25%

Off

Get Premium CCCS-203b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Aleta

4 days ago

Just use the existing IOM policies, saves time!

upvoted 0 times

...

Jolene

9 days ago

Wow, this is a lot of cloud security jargon. I'm just going to go with D and hope for the best.

upvoted 0 times

...

Rodney

14 days ago

D) for sure. CrowdStrike has got this covered, no need to waste time on custom policies.

upvoted 0 times

...

Glenn

20 days ago

Haha, who even uses CloudShell these days? I just SSH in like a real engineer.

upvoted 0 times

...

Sanjuana

25 days ago

Hmm, I was thinking B) but you make a good point. Existing policies are probably the easiest option.

upvoted 0 times

...

Desmond

30 days ago

D) Leveraging existing IOM policies is the way to go. No need to reinvent the wheel here.

upvoted 0 times

...

Lorenza

1 month ago

I recall that IOAs are more about runtime detections, so I guess they wouldn't help with visibility into IAM controls like CloudShell.

upvoted 0 times

...

Latosha

1 month ago

I feel like creating custom IOM policies could be overkill since CrowdStrike has prebuilt ones, but I'm not 100% confident.

upvoted 0 times

...

Ty

2 months ago

I think we practiced a similar question about leveraging existing IOM policies for AWS security checks. That might be the right approach.

upvoted 0 times

...

Erasmo

2 months ago

I remember studying the differences between IOA and IOM policies, but I'm not entirely sure which one applies here.

upvoted 0 times

...

Mel

2 months ago

Hmm, I'm still a bit unsure about the difference between IOA and IOM policies. But based on the explanation in the question, it seems like the IOM policies are the way to go here to get the visibility we need across the different cloud platforms.

upvoted 0 times

...

Kimbery

3 months ago

I'm feeling pretty confident about this one. The question is clearly guiding us towards the IOM policies as the solution, and not the custom IOA policies. As long as we understand the difference between those two, we should be able to select the right answer.

upvoted 0 times

...

Nickolas

3 months ago

Yeah, I agree with that strategy. The question is pretty straightforward - we just need to use the pre-built IOM policies that CrowdStrike maintains to get the visibility we need into the AWS IAM controls and CloudShell usage.

upvoted 0 times

...

Meaghan

3 months ago

Okay, I think I've got this. The key is that we need to leverage the existing IOM policies that CrowdStrike provides, which are already aligned with the CIS Foundations Benchmarks. Creating custom policies would just be extra work.

upvoted 0 times

...

Isreal

3 months ago

I'm a bit confused by the terminology in this question. What are IOA and IOM policies exactly, and how do they relate to the CIS Foundations Benchmarks?

upvoted 0 times

...