Discuss CrowdStrike CCCS-203b Exam Topic 6 Question 1

What is needed to achieve visibility into the latest AWS IAM 1020 restricted use of AWS CloudShell with the latest CIS Foundations Benchmarks for AWS, Azure, and Google Cloud?

ALeverage existing IOA policy

BCreate custom IOA policy

CCreate custom IOM policy

DLeverage existing IOM policy
Visibility into AWS IAM controls, including restricted use of AWS CloudShell (CIS IAM 1.20), is provided through CrowdStrike Falcon Cloud Security posture management using Indicators of Misconfiguration (IOMs). These checks continuously evaluate cloud resources against industry-standard benchmarks, including the CIS Foundations Benchmarks for AWS, Azure, and Google Cloud.
CrowdStrike maintains prebuilt, managed IOM policies that are automatically updated to reflect the latest CIS guidance. Leveraging existing IOM policies ensures immediate coverage without the operational risk or overhead of creating and maintaining custom rules. These policies assess IAM configurations, permissions usage, service access controls, and policy enforcement related to CloudShell usage.
IOAs are designed for runtime behavioral detections and are not suitable for posture or configuration validation. Creating custom IOMs is unnecessary for CIS-aligned controls because CrowdStrike already provides validated, benchmark-mapped policies maintained by CrowdStrike security research.
Therefore, leveraging existing IOM policies is the correct and recommended approach to maintain continuous, benchmark-aligned visibility across multi-cloud environments.

Suggested Answer: D

Get Premium CCCS-203b Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Huey 3 months ago

Nah, existing IOM policies cover it all. Why reinvent the wheel?

Graham 3 months ago

But what if we need specific controls? Custom IOA might help.

Toi 3 months ago

Agreed! Custom policies just add complexity.

Glendora 3 months ago

I think leveraging existing IOM policy is the best choice. Less hassle.

Vi 5 months ago

I’m not so sure about that, what if they miss something critical?

Marge 5 months ago

Leveraging existing policies is definitely the way to go!

Leslie 5 months ago

Wait, are custom IOMs really unnecessary? That sounds too easy.

Jackie 5 months ago

I agree, no need to reinvent the wheel here.

Aleta 6 months ago

Just use the existing IOM policies, saves time!

Jolene 6 months ago

Wow, this is a lot of cloud security jargon. I'm just going to go with D and hope for the best.

Rodney 6 months ago

D) for sure. CrowdStrike has got this covered, no need to waste time on custom policies.

Glenn 6 months ago

Haha, who even uses CloudShell these days? I just SSH in like a real engineer.

Sanjuana 6 months ago

Hmm, I was thinking B) but you make a good point. Existing policies are probably the easiest option.

Desmond 6 months ago

D) Leveraging existing IOM policies is the way to go. No need to reinvent the wheel here.

Lorenza 7 months ago

I recall that IOAs are more about runtime detections, so I guess they wouldn't help with visibility into IAM controls like CloudShell.

Latosha 7 months ago

I feel like creating custom IOM policies could be overkill since CrowdStrike has prebuilt ones, but I'm not 100% confident.

Ty 8 months ago

I think we practiced a similar question about leveraging existing IOM policies for AWS security checks. That might be the right approach.

Erasmo 8 months ago

I remember studying the differences between IOA and IOM policies, but I'm not entirely sure which one applies here.

Mel 8 months ago

Hmm, I'm still a bit unsure about the difference between IOA and IOM policies. But based on the explanation in the question, it seems like the IOM policies are the way to go here to get the visibility we need across the different cloud platforms.

Kimbery 8 months ago

I'm feeling pretty confident about this one. The question is clearly guiding us towards the IOM policies as the solution, and not the custom IOA policies. As long as we understand the difference between those two, we should be able to select the right answer.

Nickolas 8 months ago

Yeah, I agree with that strategy. The question is pretty straightforward - we just need to use the pre-built IOM policies that CrowdStrike maintains to get the visibility we need into the AWS IAM controls and CloudShell usage.

Meaghan 8 months ago

Okay, I think I've got this. The key is that we need to leverage the existing IOM policies that CrowdStrike provides, which are already aligned with the CIS Foundations Benchmarks. Creating custom policies would just be extra work.

Isreal 9 months ago

I'm a bit confused by the terminology in this question. What are IOA and IOM policies exactly, and how do they relate to the CIS Foundations Benchmarks?

Larae 2 months ago

↳ replying to Isreal

IOM is Indicators of Misconfiguration, I think.

Simona 3 months ago

↳ replying to Isreal

IOA is for Indicators of Attack, right?

Goldie 3 months ago

↳ replying to Isreal

What do IOA and IOM stand for?

CrowdStrike CCCS-203b Exam - Topic 6 Question 1 Discussion