Discuss CrowdStrike CCCS-203b Exam Topic 7 Question 10

You receive an alert that one of your container images contains AWS credentials stored in cleartext.

What detection type should you search for to investigate?

ASuspicious file

BMisconfiguration

CExposed credential

DSecret
When CrowdStrike Falcon detects cloud credentials---such as AWS access keys---stored in cleartext within a container image, the finding is classified as a Secret detection. Secrets include sensitive data such as API keys, access tokens, passwords, and cryptographic material embedded in container images, configuration files, or source code.
Falcon Cloud Security performs deep inspection of container images during image assessment to identify hard-coded secrets before those images are deployed into runtime environments. Storing AWS credentials in cleartext represents a critical security risk because attackers who gain access to the image can easily extract and misuse those credentials to access cloud resources.
While misconfigurations focus on insecure cloud settings and suspicious files relate to potentially malicious artifacts, secret detections are specifically intended to highlight exposed sensitive information. The Exposed credential option may sound similar, but within CrowdStrike's detection taxonomy for container and image security, these findings are categorized under Secret detections.
Investigating Secret detections allows security teams to quickly identify where credentials are embedded, rotate compromised keys, and remediate the issue by using secure alternatives such as cloud-native secrets managers or environment-based injection mechanisms. Therefore, the correct detection type to search for is Secret.

Suggested Answer: D

Get Premium CCCS-203b Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Stanford 4 days ago

I think it's definitely a Secret detection. Cleartext credentials are a big risk.

Dylan 9 days ago

C) Exposed credential sounds close, but Secret is more accurate in this context.

Dalene 14 days ago

D) Secret is definitely the best choice. Cleartext credentials are a big risk.

Paris 20 days ago

B) Misconfiguration is too broad for this issue.

Jenelle 25 days ago

I feel like A) Suspicious file could also be relevant, but not as much.

Rosendo 30 days ago

Agreed! Secrets are critical to identify.

Ben 1 month ago

I think the answer is D) Secret. It makes sense for exposed credentials.

Daniel 1 month ago

D) Secret is the best choice. We need to protect sensitive info!

Joni 2 months ago

C) Exposed credential sounds close, but it's categorized under Secret.

Wilbert 2 months ago

B) Misconfiguration doesn't fit. We're looking at credentials, not settings.

Charlie 2 months ago

I feel like A) Suspicious file could be misleading. It's not just about files.

Levi 2 months ago

Agreed! Secrets are definitely the right focus here.

Mozell 2 months ago

I think the answer is D) Secret. It makes sense for exposed credentials.

Oretha 2 months ago

Yeah, but isn't it also a Suspicious file if it's hidden in the image?

Elli 3 months ago

Wow, I didn't realize how risky cleartext credentials could be!

Adolph 3 months ago

Seems obvious, but I can see how people might confuse it with Exposed credential.

Roslyn 3 months ago

I thought it was a Misconfiguration at first.

Fernanda 3 months ago

Definitely a Secret detection!

Lashon 3 months ago

I disagree, I think Suspicious file could also apply here.

Brandon 3 months ago

Exposed credential sounds right, but I guess it falls under Secret.

Cletus 4 months ago

Wait, are we really still finding AWS keys in cleartext? That's surprising!

Jade 4 months ago

I thought it might be Misconfiguration, but Secret makes more sense.

Isabella 4 months ago

Definitely a Secret detection. Cleartext credentials are a big no-no!

Stefan 4 months ago

I’m leaning towards D) Secret as well, but I wonder if they might try to trick us with the Exposed credential option.

Kate 4 months ago

Misconfiguration sounds like it could fit too, but I feel like that's more about settings rather than actual credentials being stored.

Eric 4 months ago

I remember practicing a question about detecting hard-coded secrets in container images. I think it was similar to this one, and the answer was definitely Secret.

Almeta 6 months ago

I think the answer is D) Secret, but I'm not entirely sure if it could also be classified as exposed credentials.

CrowdStrike CCCS-203b Exam - Topic 7 Question 10 Discussion