Option A: Deleting and recreating the rule is inefficient and could lead to downtime or loss of historical data. The rule should be edited instead.
Option B: There is no CLI functionality for modifying IOM rules in Falcon Cloud Security. All IOM rule management is handled through the console.
Option C: Falcon Cloud Security provides a straightforward interface for editing existing custom IOM rules, including modifying IP ranges or other parameters.
Option D: AWS Security Groups are not a replacement for Falcon Cloud Security's IOM rules.
Security Groups are limited to network-level access control and do not offer the runtime detection capabilities of IOM rules.

Option A: Real-time monitoring is complementary to scheduled assessments but is not a prerequisite for setting up an assessment schedule. Scheduled assessments operate independently of real-time monitoring.
Option B: Assigning permissions is the foundational step for CSPM setup. It allows Falcon to retrieve the required telemetry and perform posture assessments effectively.
Option C: Tagging resources may be useful for focused assessments, but it is not mandatory.
Falcon automatically evaluates the entire cloud environment by default unless specified otherwise.
Option D: While selecting the frequency is an essential step, it cannot be completed unless the necessary permissions are granted to Falcon for API access. Without these permissions, the assessments cannot run.

To confirm whether malware exists within a container image, CrowdStrike Falcon Cloud Security directs investigators to reviewImage detection findings. These findings are generated during container image assessments, where Falcon performs deep inspection of image layers, binaries, and embedded artifacts.
Image detection findings include indicators of known malware, suspicious executables, malicious scripts, and other threats identified through CrowdStrike's threat intelligence and detection engines. Because container images are often reused across environments, identifying malware at the image level is critical to preventing widespread propagation.
Other options do not directly confirm malware within an image.Drift indicatorsrelate to changes in a running container compared to its original image, not malware embedded in the image itself.Container alertsare typically runtime detections triggered by behavior during execution.Container misconfigurationsfocus on insecure settings rather than malicious code.
By reviewing image detection findings, security teams can identify infected images early, remediate by rebuilding clean images, and prevent deployment through policy enforcement mechanisms such as the Kubernetes Admission Controller. Therefore, the correct investigation path for suspected malware in a container image isImage detection findings.

Option A: Network-based intrusion detection systems (NIDS) monitor network traffic for malicious activity but do not assess container images for vulnerabilities before deployment. They are useful for runtime threat detection, not pre-runtime protection.
Option B: Sandboxing isolates applications to observe their behavior and detect potential threats.
However, this method is typically used for testing unknown executables rather than scanning container images in a registry before deployment. It does not provide proactive pre-runtime assessment.
Option C: Registry scanning is the most effective method for assessing container images before they are deployed. It integrates with container registries (e.g., Amazon ECR, Azure Container Registry, Google Artifact Registry) to scan images for vulnerabilities, misconfigurations, and malware before they are pulled into a runtime environment. This pre-runtime approach ensures security compliance across multiple cloud platforms.
Option D: Host-based scanning is focused on identifying threats already present on a running system. While useful for runtime protection, it does not prevent vulnerable images from being deployed in the first place, making it an inadequate choice for pre-runtime security.

Option A: RBAC is a critical requirement for deploying the Kubernetes protection agent. It ensures that the agent has the necessary permissions to monitor and protect the cluster effectively. Without proper RBAC configuration, the agent cannot access required resources or enforce security policies.
Option B: While enabling Kubernetes audit logs is a good practice for security monitoring, it is not a substitute for configuring the Kubernetes protection agent. The agent requires additional setup to monitor and protect workloads effectively.
Option C: Granting full administrative privileges to all service accounts violates the principle of least privilege and increases the attack surface. The agent requires specific permissions, which can be granted using RBAC without over-provisioning access.
Option D: Installing the agent directly on individual containers is not how the Kubernetes protection agent operates. The agent is deployed at the node level or via DaemonSet to monitor containerized workloads across the cluster.