CrowdStrike CCCS: CrowdStrike Certified Cloud Specialist (CCCS)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1Falcon Cloud Security Features and Services

   A security architect wants one console view that continuously checks AWS and Azure account settings against benchmark-based rules and flags misconfigurations such as publicly readable storage. Which Falcon Cloud Security capability fits this need best?

   1. ACloud Security Posture Management (CSPM)
   2. BCloud Workload Protection (CWP)
   3. CApplication Security Posture Management for code repositories
   4. DData Security Posture Management for sensitive stored records
   Show answer and explanationHide answer

   Correct answer: A

   CSPM continuously evaluates cloud account and service configuration against policies and benchmarks, which is how it surfaces publicly readable storage. CWP protects running workloads, while ASPM and DSPM focus on application code and sensitive data, so neither matches the request.

2. Question 2Cloud Account Registration

   A security engineer needs Falcon to evaluate configuration in a new AWS account. Which action must happen before CSPM findings for that account can appear?

   1. AA Falcon sensor must be installed on every EC2 instance in the account first
   2. BThe account is attached to an image assessment policy exclusion list for scanning
   3. CThe account is registered so Falcon has permission to read its configuration
   4. DA Fusion workflow is created to export all findings from the account to a spreadsheet
   Show answer and explanationHide answer

   Correct answer: C

   CSPM evaluates configuration through account registration, which gives Falcon permission to read the account's settings, so no sensor is needed on each instance. Sensors, image exclusions and spreadsheet exports are not prerequisites for CSPM findings to appear.

3. Question 3Cloud Security Policies and Rules

   A team needs CSPM rules to apply only to production accounts and leave development accounts unaffected. Which approach best meets this need?

   1. AApply the policy to every account and then add a note to the development accounts
   2. BCreate a duplicate of each CSPM policy and give the copies a production label
   3. CTurn off CSPM for the whole tenant and rely on manual reviews of production systems
   4. DAssign the CSPM policy to a cloud group that holds only production accounts
   Show answer and explanationHide answer

   Correct answer: D

   Assigning a CSPM policy to a cloud group that contains only production accounts scopes evaluation without duplicating policies or turning off coverage. Applying the policy to all accounts with a note, copying policies, or disabling CSPM does not enforce the intended scope.

4. Question 4Pre-Runtime Protection

   A developer pushes a new container image to a registry. The image contains a hard-coded API token in an environment file. Which Falcon capability would most directly flag this before deployment?

   1. ARuntime indicator of attack (IOA) detection on the running container
   2. BFusion workflow that opens a ticket after the workload is deployed
   3. CCSPM check for publicly readable object storage buckets
   4. DLeaked secrets detection during image assessment
   Show answer and explanationHide answer

   Correct answer: D

   Leaked secrets detection during image assessment finds credentials or tokens stored in image content before the image is deployed. Runtime IOA detection acts on live behaviour, CSPM checks account configuration, and Fusion workflows act after events, so none of them catch the token in the image.

5. Question 5Runtime Protection

   A Kubernetes cluster runs third-party and internal container images, and the team wants runtime visibility into container processes. Which option should they evaluate first?

   1. AA browser extension installed on the Kubernetes dashboard for administrators
   2. BA Falcon sensor built for container and Kubernetes environments
   3. CA DNS resolver set as the cluster ingress default for all traffic
   4. DA USB device control policy applied to every worker node in the cluster
   Show answer and explanationHide answer

   Correct answer: B

   A Falcon sensor built for container and Kubernetes environments provides runtime visibility into container workloads on the cluster. A browser extension, a DNS setting or a USB policy does not provide runtime protection for container processes.