Option A: An annual report frequency is insufficient for real-time threat mitigation. Security teams require more frequent updates, such as daily or weekly, to respond effectively to emerging threats.
Option B: While executives need summaries, sharing reports exclusively with them prevents the security team from accessing actionable insights necessary for day-to-day threat response.
Option C: Configuring filters ensures that the report highlights relevant and actionable threats.
Excluding benign detections reduces noise and allows the security team to focus on critical IOAs and IOMs, improving response efficiency. Mismanaging filters can overwhelm the team with unnecessary data or omit key threats.
Option D: Limiting the report to IOAs ignores IOMs, which are critical for understanding malicious patterns. Both indicators are essential for a comprehensive threat landscape view.

Option A: API clients and keys do not store data; they are tools for accessing and interacting with the Falcon platform programmatically. Telemetry data is collected and stored separately in the cloud.
Option B: Endpoint agents use specific registration processes and do not rely on API clients or keys for initial registration. API keys are primarily for integrations and programmatic tasks.
Option C: MFA is a user authentication mechanism and not related to API clients and keys. API keys are used for programmatic access rather than human user authentication.
Option D: API clients and keys are used to establish secure, programmatic access to the Falcon platform for integration with third-party applications, enabling automated workflows and data exchange.

Option A: Frequent access key rotation improves security and aligns with best practices, reducing exposure to credential compromise.
Option B: Read-only access for developers in production is a controlled permission and does not present a high risk unless misused.
Option C: Service accounts with limited permissions are a best practice for automated processes and do not pose a significant security risk.
Option D: Inactive administrator accounts pose a major security risk because they could be compromised without detection. Attackers often target dormant accounts to escalate privileges and gain unauthorized access.

Option A: Denying access to sensitive resources for unauthorized roles enhances security and ensures that users cannot access resources they are not entitled to.
Option B: Read-only access aligns with least privilege, ensuring analysts can view data without modifying it. This is a correctly configured policy.
Option C: This misconfiguration grants excessive privileges to all users, violating the principle of least privilege and increasing the risk of accidental or intentional misuse. Access to production environments should be tightly controlled and limited to specific, authorized roles.
Option D: Granting developers permissions tailored to their role in a non-production environment aligns with best practices and does not pose a security risk.

Option A: The "Access Permissions" tab focuses on roles, policies, and entitlements. It does not store password change history, making this option incorrect.
Option B: Authentication events show login attempts and session data but do not track password changes. This approach would not yield the desired information.
Option C: The "Password Change Insights" feature in CrowdStrike Identity Analyzer provides a centralized and user-friendly interface to track password change events. It is specifically designed for auditing and identifying such activity efficiently without relying on external tools or manual log searches.
Option D: While querying the cloud provider's API might work, it is time-consuming and requires advanced knowledge of the API. CrowdStrike Identity Analyzer already consolidates this information, making this step unnecessary.