In CrowdStrike Falcon Cloud Security, Cloud Groups can be applied to container images using three specific image attributes: Image registry, Image repository, and Image tag. These attributes uniquely identify container images and allow precise scoping of policies and visibility.
Image registry identifies where the image is hosted (for example, Amazon ECR or Docker Hub).
Image repository defines the namespace or project within that registry.
Image tag specifies the version or variant of the image.
Together, these attributes provide a consistent and cloud-native method to group images across environments.
Other attributes such as image version or type are not used as Cloud Group selectors in Falcon. Therefore, the correct answer is Image registry, Image repository, and Image tag.

InFalcon Cloud Security Network Events, port states reflect how network connections are established and handled at runtime. The platform uses standardized connection state terminology to help analysts understand traffic behavior and intent.
The three valid port states are:
* Connect: Indicates an outbound connection attempt initiated by a process or container.
* Accept: Represents an inbound connection that was accepted by a listening process.
* Listen: Shows that a process is actively listening on a port for incoming connections.
These states provide crucial context for detecting suspicious behavior such as unauthorized listeners, unexpected inbound access, or abnormal outbound communications. Other options include terms not used by Falcon to define port state semantics within Network Events.
Therefore,Connect, Accept, and Listenis the correct answer.

Option A: Excluding all system processes creates a significant security risk and is not an effective way to manage false positives.
Option B: Editing the existing policy is sufficient and does not require deletion. Recreating policies unnecessarily increases administrative overhead.
Option C: Lowering the sensitivity of "Exploit Detection" can help reduce false positives by adjusting the thresholds for detecting potential threats. This action retains proactive protection while improving alert accuracy.
Option D: Policy priority affects which policy is applied when multiple policies overlap but does not address false positives within a policy.

The CrowdStrike Kubernetes Admission Controller is apre-runtime security controldesigned to enforce security policiesbefore workloads are allowed to runin a Kubernetes environment. Its primary purpose is to monitor and enforce security policies in any containerized environmentby intercepting Kubernetes API requests at admission time.
When a deployment, pod, or container is submitted to the Kubernetes API server, the Admission Controller evaluates the request against Falcon Cloud Security policies. These policies can include rules related to image risk posture, vulnerabilities, malware presence, secrets, or compliance violations. If an image violates defined policies, the Admission Controller can block the deployment, preventing insecure or non-compliant workloads from entering the cluster.
This capability is critical for implementing ashift-left security model, ensuring that threats are stoppedbefore runtime, rather than detected after execution. While Falcon also provides runtime protection and visibility across managed Kubernetes platforms such as EKS and AKS, those capabilities are not the primary function of the Admission Controller itself.
The Admission Controller does not forward Kubernetes logs to SIEM platforms; instead, it acts as an enforcement gate. Therefore, the correct answer isMonitors and enforces security policies in any containerized environment.

Falcon Cloud Security categorizes IOAs usingMITRE ATT&CK tactics and techniques, enriched with cloud-provider contextto accurately represent cloud-native attack behavior.
To identifyDefense Evasion via Impair Defenses: Disable or Modify Toolsactivity specifically withinAzure
, analysts must filter IOAs usingMITRE Tactic and Techniquewhile also scoping the environment to the cloud provider. This ensures visibility into attacker behaviors such as disabling logging, modifying security services, or impairing monitoring controls at the cloud-provider level.
Filtering by attack type alone lacks the structured MITRE mapping required for accurate investigative workflows. Service-level filters are insufficient because impairment of defenses in cloud environments often impacts provider-managed services rather than individual workloads.
Therefore,MITRE Tactic and Technique - Cloud provideris the correct and most precise filter to identify Azure-specific defense evasion IOAs.