Option A: Falcon Horizon is designed for cloud security posture management (CSPM) and not for runtime protection of workloads. While it helps identify misconfigurations and compliance issues, it does not directly secure containerized or non-containerized workloads.
Option B: While the Falcon Kubernetes Sensor provides excellent runtime protection for containerized workloads in Kubernetes environments, it does not extend its capabilities to non- containerized workloads, making it insufficient for hybrid environments.
Option C: Falcon Container Sensor is optimized for securing containerized workloads, including runtime protection and integration with CI/CD pipelines. Additionally, it can coexist with Falcon Linux Sensor to provide coverage for hybrid environments, making it the best choice in this scenario.
Option D: The Falcon Linux Sensor is ideal for securing traditional Linux workloads but does not provide the specific runtime container protection and orchestration-level insights needed for Kubernetes-based environments.

Option A: Multi-stage builds are a best practice for creating minimal and efficient images by excluding unnecessary build artifacts. This enhances security by reducing the attack surface. It is not a misconfiguration.
Option B: This is a best practice to enhance security. Running the application as a non-root user reduces the impact of a potential compromise, as the attacker's privileges would be limited. This is not a misconfiguration but a security-strengthening measure.
Option C: While using official base images is a good starting point, they can still contain vulnerabilities. Scanning these images for known issues before use is a necessary step to ensure security compliance. Relying solely on their "official" status is a common misconception.
Option D: Hardcoded credentials in environment variables are a critical security misconfiguration.
If the image is shared or deployed in an environment where logs or configurations can be accessed, these credentials can be exposed, leading to unauthorized access. Best practices recommend using a secure secrets management solution instead of hardcoding sensitive information.

Option A: Transferring permissions without a clear business need or appropriate analysis can lead to excessive privilege assignments and violate the principle of least privilege, increasing the risk of insider threats or accidental misuse.
Option B: Temporarily disabling inactive accounts allows organizations to verify whether the accounts are genuinely no longer in use while preventing immediate security risks. Monitoring for unexpected activity during the temporary disablement phase helps identify potential misuse or ongoing necessity of the account, ensuring informed decisions about deactivation or deletion.
Option C: Deactivating accounts without addressing roles and permissions still poses a security risk. Inactive accounts with retained permissions can be re-enabled or misused inappropriately.
Option D: While deleting inactive accounts removes potential attack vectors, this approach is risky without prior analysis. Some accounts may be needed for legacy systems or auditing purposes, leading to operational disruption.

Option A: Third-party solutions often require additional agents or sensors, which contradicts the question's premise. Moreover, using these tools typically involves additional configuration and integration steps.
Option B: The Kubernetes API server provides detailed insights into the current state of pods and containers in a cluster. By querying the API with tools like kubectl, administrators can list running containers, view their status, and identify runtime configurations without deploying additional agents. This method leverages existing infrastructure for visibility.
Option C: Docker's built-in runtime monitoring is limited in scope and does not integrate with Kubernetes orchestration layers. Additionally, it is not enabled by default in most environments, making it unsuitable for cloud-scale Kubernetes clusters.
Option D: While installing a Falcon sensor on cluster nodes offers enhanced security monitoring and runtime protection, the question specifies identifying running containers without deploying a Falcon sensor, making this option incorrect.

In CrowdStrike Falcon Cloud Security, Cloud Groups are used to logically group container images so that policies, assessments, and controls can be applied consistently across workloads. When editing or defining a Cloud Group for container images, Falcon allows administrators to select specificimage propertiesto precisely target the desired scope.
The three supported image properties areRegistry, Repository, and Tag.
* Registryidentifies where the container image is hosted, such as Amazon ECR, Azure Container Registry, or Docker Hub.
* Repositorydefines the image namespace or project within the registry.
* Tagspecifies the image version or variant (for example, latest, v1.2.3, or prod).
Using these three properties together enables highly granular targeting. For example, security teams can apply stricter policies only to production-tagged images from a specific registry and repository, while allowing more flexibility for development images.
Options that includeNameare incorrect because CrowdStrike does not use a standalone "image name" field when defining Cloud Group image criteria. Instead, image identity is derived from the combination of registry, repository, and tag.
Therefore, the correct and fully supported selection isRegistry, Repository, and Tag, which aligns with CrowdStrike Falcon Cloud Security configuration and documentation.