Option A: While using the latest version is generally good practice, it must be from a verified source and appropriately reviewed. Blindly trusting the latest version can still introduce unnecessary dependencies or vulnerabilities.
Option B: This is the correct answer because minimal base images reduce the attack surface by limiting the included software to only what is necessary for the application to run. This approach minimizes potential vulnerabilities and simplifies vulnerability management.
Option C: Runtime tools are important but are not a substitute for secure image practices. Images must be secured at the build and review stages to prevent vulnerabilities from reaching runtime.
Option D: This increases the attack surface because each additional tool or dependency introduces more potential vulnerabilities. Custom images should be minimal and tailored to application requirements.

Option A: Simply tagging the devices without further action does not address the potential security risks associated with unmanaged assets. Additional steps, such as identifying and deploying the Falcon sensor, are required.
Option B: Unmanaged devices pose significant security risks, regardless of their perceived criticality. Ignoring them could lead to blind spots in your security posture.
Option C: Blocking these devices at the firewall could disrupt legitimate operations, particularly if they are critical to business processes. Investigating and managing them is a better approach.
Option D: Deploying the Falcon sensor is the most appropriate action to ensure these unmanaged assets are properly monitored and secured. Without the Falcon sensor, these devices remain unprotected and could serve as attack vectors. This step ensures they are brought under management and included in the asset inventory for continuous monitoring.

Option A: Automatically disabling users without a thorough analysis could lead to operational disruptions. CIEM performs a comprehensive assessment, considering factors like API activity, to ensure accurate detection of inactivity.
Option B: Reassigning roles without first verifying the user's purpose or activity may increase security risks. CIEM focuses on identifying and managing inactive users, not on role reassignment as a default action.
Option C: While CrowdStrike Falcon excels at endpoint detection and response (EDR), it is not designed for analyzing cloud identity and access management (IAM) activities. Relying on Falcon for such tasks is both inefficient and ineffective compared to using CIEM.
Option D: CIEM's Identity Analyzer is specifically designed to monitor and analyze user activity patterns across cloud environments. It can automatically detect inactive users based on their login, API activity, and resource usage. This capability reduces the risk of overprivileged or orphaned accounts. Using CIEM ensures efficiency and eliminates the manual overhead of user analysis.

Option A: Password expiration enforcement is a policy-driven mechanism, not a detection feature.
The question specifically asks about identifying stale passwords, not enforcing policy compliance.
Option B: While integration with cloud provider logs is part of the Identity Analyzer's capabilities, this approach alone does not detect stale passwords effectively. Additional processing, such as the Stale Credential Detection feature, is required to analyze and identify such users.
Option C: The Stale Credential Detection feature of the CrowdStrike Identity Analyzer proactively identifies credentials, including passwords, that have not been updated within a specified time period. This is the most accurate and direct solution for the scenario.
Option D: Sending reminders may encourage users to change passwords, but it is not a detection mechanism for stale passwords. The question is about identifying stale credentials, not prompting updates.

Option A: Defining exclusions allows organizations to tailor the scan to their unique requirements, ignoring vulnerabilities that are deemed low-risk or acceptable. While optional, this step is commonly implemented for effective vulnerability management.
Option B: The Falcon Image Scanning Script does not require you to register the container registry with the Falcon platform for CI/CD pipeline integration. Instead, the script operates by pulling images directly from the registry or receiving image references as input. Continuous registry scanning is a separate feature and not a prerequisite for CI/CD pipeline integration.
Option C: Installing the script on the build server is a necessary step to ensure the CI/CD environment can execute scans on container images during the pipeline process.
Option D: Mapping the output directory is essential to store scan results and reports where they can be accessed by subsequent pipeline steps or developers for review.