Option A: This is not a valid CrowdStrike product. It may cause confusion due to the association with Kubernetes but does not exist as an offering.
Option B: The Falcon Host Sensor is designed for traditional workloads like virtual machines or physical servers. It does not natively integrate with containerized environments or provide detailed insights into container activities.
Option C: While Falcon CWP offers security for cloud-native workloads, it focuses on configuration assessment and vulnerability management rather than real-time runtime visibility for container activities. It is not specifically optimized for monitoring container behavior within Kubernetes environments.
Option D: The Falcon Container Sensor is specifically tailored for containerized environments, providing runtime protection, visibility, and threat detection. It integrates well with Kubernetes deployments, including Amazon EKS, making it the most appropriate choice in this scenario.

CrowdStrike Falcon Cloud Security supportsscheduled reportingas the preferred mechanism for automatically distributing security findings to stakeholders who may not have direct access to the Falcon console. When container vulnerabilities need to be reviewed on aweekly basis, the correct and most operationally efficient approach is tocreate a scheduled report covering the last 7 days.
Scheduled reports can be configured to run automatically and delivered via email to designated recipients, including users without Falcon console access. This makes them ideal for cross-functional teams, auditors, or management who require regular visibility into container risk without interactive access.
UsingAdvanced Event Searchrequires console access and manual execution, which does not meet the requirement for automatic distribution. Dashboards also require console access and cannot be securely shared externally. A 24-hour report would not align with the stated weekly review cadence and could result in incomplete visibility.
CrowdStrike documentation and best practices recommend scheduled reports for recurring compliance, vulnerability, and risk reporting use cases. Therefore, the correct solution is tocreate a scheduled report to list vulnerable container data from the last 7 days.

Option A: This answer is correct because registering a cloud account in CrowdStrike Falcon requires establishing a secure connection via IAM roles with read-only access. This allows Falcon to monitor and analyze configurations, services, and activity logs within the cloud account without making changes to the cloud environment.
Option B: This is incorrect because CrowdStrike Falcon integrates directly with cloud platforms to retrieve activity logs automatically. Manual log uploads are not required.
Option C: This is incorrect because installing agents on virtual machines is part of endpoint protection, not cloud account registration. Cloud accounts are registered at the platform level (AWS, Azure, GCP) rather than individual machines.
Option D: This is incorrect because network security group configurations are unrelated to the cloud account registration process. CrowdStrike communicates via APIs and does not require inbound network traffic to cloud accounts for registration.

When creating animage groupin CrowdStrike Falcon Cloud Security, valid attributes must align with how container images are uniquely identified and organized. The supported attributes includerepository and image tags, which together allow precise grouping of related images.
Therepositorydefines the image namespace or project within a registry, whileimage tagsrepresent versions or variants such as latest, prod, or semantic versions. Using these attributes enables security teams to target policies and assessments consistently across image versions without relying on static names.
Options involvingimage nameare incorrect because Falcon does not use a standalone image name field for grouping. Image identity is derived from registry, repository, and tag combinations. Registry can be used in some grouping contexts, but for image groups specifically, repository and tag are the valid selectable attributes.
Therefore, the correct answer isRepository and Image tags.

Option A: While missing a health check directive is not ideal for production readiness, it is not a security misconfiguration. Health checks are primarily for operational monitoring and ensuring high availability.
Option B: This is a best practice to ensure only authorized users can access the image. It strengthens the security of the deployment pipeline and does not represent a misconfiguration.
Option C: Adding labels for versioning and maintainability metadata (e.g., LABEL version="1.0") is a best practice. It aids in managing image lifecycles and troubleshooting deployments. This does not constitute a misconfiguration.
Option D: Including unused software packages increases the attack surface and may introduce unnecessary vulnerabilities. Attackers could exploit unmaintained or outdated components, even if they are not actively used by the application. Removing unnecessary packages during the build process is a key security best practice.