Option A: Threat intelligence feeds enhance detection of malicious activity, but they are not specifically tailored for identifying unassessed container images in runtime environments.
Option B: CrowdStrike Falcon includes drift detection, which identifies when a running container image deviates from its baseline configuration or assessment status. This real-time feature allows security teams to pinpoint unassessed images and mitigate risks proactively. Runtime visibility ensures any image running without prior assessment is flagged.
Option C: Manual audits are time-consuming and prone to human error. They lack the scalability and real-time capabilities provided by tools like CrowdStrike Falcon for detecting unassessed images in runtime.
Option D: While network segmentation can limit the impact of compromised containers, it does not address identifying or mitigating risks from unassessed images directly.

Option A: Packet analysis tools are useful for understanding network behaviors but do not provide insights into specific runtime processes within workloads. They address different aspects of security and visibility.
Option B: Falcon Horizon is designed for cloud security posture management (CSPM), focusing on misconfigurations and compliance issues rather than runtime visibility into workloads or processes.
Option C: Falcon Discover offers an agentless solution that integrates seamlessly with cloud environments to identify running workloads. This aligns with runtime protection principles and allows security teams to identify active instances, workloads, and other resources without deploying a Falcon sensor.
Option D: Manual scanning through SSH is time-consuming, error-prone, and not scalable for large cloud environments. It also lacks the centralized visibility and automation offered by Falcon Discover.

Option A: While this helps identify runtime issues and integration problems, it does not address the specific task of reviewing an image for vulnerabilities. This step should come after ensuring the image is free from known vulnerabilities.
Option B: This is the correct answer because vulnerability scanning tools are specifically designed to identify known vulnerabilities in container images. These tools analyze both the image layers and dependencies, providing a comprehensive list of vulnerabilities that need to be addressed. This is a critical first step before proceeding with deeper analysis or deployment.
Option C: Resource utilization metrics are used for performance monitoring and optimization, not vulnerability identification. They do not provide any insights into the security posture of the container image.
Option D: This is an important step, but it is not the most critical first step. Manual inspection is prone to human error and cannot detect vulnerabilities in the underlying dependencies or base image layers.

Option A: The falconctl tool is used for endpoint management, not for retrieving scan results.
Additionally, --scan-id is not a valid flag in this context.
Option B: CrowdStrike does not automatically send scan results via email. Results are viewed through the console or programmatically retrieved using APIs.
Option C: The falcon image-scan command does not have a --results flag. Results must be viewed in the Falcon console or through an API query.
Option D: The "Image Scans" tab in the Falcon console is the primary location for viewing detailed results of manual or automated scans. This interface provides comprehensive information, including vulnerabilities and remediation steps.

Drift indicators in the Containers dashboard are used to identify containers performing activity that deviates from their original image configuration. Drift occurs when files, binaries, or processes appear in a running container that were not present in the image at build time.
CrowdStrike Falcon Cloud Security tracks this behavior to help identify compromised containers, unauthorized changes, or violations of immutability principles. Drift indicators are especially valuable in production environments where containers are expected to remain unchanged after deployment.
Alerts and container detections may signal malicious behavior, but drift indicators specifically highlight unexpected changes relative to the image baseline. Therefore, the correct answer is Drift indicators.