When using theFalcon Kubernetes Admission Controller, CrowdStrike allows administrators to precisely scope which Kubernetes assets are evaluated againstIndicators of Misconfiguration (IOMs)andImage Assessment policiesby usingboth namespaces and pod or service labels.
Namespaces provide a logical boundary within Kubernetes clusters, often representing environments such as dev, staging, or production. Labels add further granularity by identifying workloads based on application, team ownership, or deployment tier. By combining namespaces and labels, security teams can enforce policies with fine-grained control while minimizing unintended enforcement.
Using only namespaces or only labels limits flexibility and may lead to over- or under-enforcement.
CrowdStrike documentation supports the combined approach as a best practice for scalable and precise policy enforcement in Kubernetes environments.
Therefore, the correct answer isNamespaces and Pod or Service labels.

Option A: The correct action to remediate an unencrypted S3 bucket is to configure the workflow to automatically update the bucket policy to enforce encryption. This action ensures future objects stored in the bucket are encrypted. Additionally, it aligns with best practices for data protection without causing disruption or data loss.
Option B: Compliance reports help in auditing and tracking but do not actively remediate the issue. This is an auxiliary action rather than a direct remediation step.
Option C: While notifications are important, they do not constitute a remediation action. This step would only alert the team to the issue without resolving it.
Option D: Deleting bucket contents may seem like a valid approach for security, but it leads to unnecessary data loss and is not a recommended remediation strategy.

When troubleshooting issues with cloud account registrations in CrowdStrike Falcon Cloud Security, thefirst stepshould be toverify the email verification process. Cloud account registration workflows rely on confirmation emails for validation, authorization, and completion of onboarding steps.
If verification emails are delayed, blocked, or misrouted due to email filtering, domain restrictions, or misconfigured mail settings, the registration process can appear to fail even though the underlying configuration is correct. Checking this process is non-disruptive and often resolves the issue quickly.
Resetting user passwords or disabling registration features are intrusive actions that should only be taken after basic validation steps are completed. CrowdStrike best practices emphasize starting with low-impact troubleshooting actions before making broader changes.
Therefore, confirming that users are receiving and completing verification emails is the correct and recommended first step.

Option A: Running a container as the root user is a critical misconfiguration because it increases the risk of privilege escalation if the container is compromised. An attacker could potentially gain elevated permissions on the host system if the container escapes isolation.
Option B: While using the "latest" tag can lead to unpredictable builds and dependency issues, it is not directly a security risk. However, it may make it harder to identify the exact image version, which could complicate vulnerability tracking.
Option C: While specifying a WORKDIR is a best practice for clarity and predictability, its absence does not inherently introduce security risks. The default working directory is the root directory of the container filesystem.
Option D: Metadata labels provide descriptive information about the image, such as the maintainer's contact. Their absence is not a security risk but rather a loss of best practices for documentation.

Option A: The "Contributor" role has elevated permissions, but if the Service Principal is actively used for its intended purpose and scoped appropriately, it is not inherently risky.
Option B: An expired credential and no roles assigned effectively nullify any risk associated with the Service Principal. It would not be flagged as risky by CIEM.
Option C: The "Reader" role is read-only and does not allow modification of resources, making it a low-risk assignment. It is scoped to an isolated environment, further reducing risk.
Option D: An unused application with "Owner" role poses significant risk because it has unrestricted permissions across the subscription. If compromised, this Service Principal could enable attackers to gain full control over the environment.