The correct answer is D. Prefix the field with Vendor .
CrowdStrike's CPS documentation says that when an event contains fields that do not exist in ECS , their names should be prefixed with the string literal Vendor. . The same guidance also says to always keep the original Vendor. field when normalizing third-party fields to ECS . That directly matches option D.
Why the other options are incorrect:
CPS does not tell you to remove non-ECS fields or leave them unstructured without normalization. It also does not say every non-compliant field must be converted into ECS. Instead, the standard preserves those vendor-specific fields under the Vendor. namespace.

PowerShell activity is visible in process execution logs and command-line data.

MTTR (Mean Time to Respond) measures response speed.

The correct answer is C. logscale-collector .
CrowdStrike's Falcon LogScale Collector installation documentation states that the service name varies by installation method. It explicitly says that for Full Installation the service is called logscale-collector , while Custom Installation uses humio-log-collector . Since the question specifically refers to deployment using the Fleet Management interface commands , that aligns with the Full Installation workflow, so the correct service name is logscale-collector .

The correct answer is C. Falcon Foundry .
CrowdStrike describes Falcon Foundry as its application development platform for building custom apps on the Falcon platform. CrowdStrike's materials state that Falcon Foundry allows customers to quickly create their own apps, and the Foundry documentation/blog content shows it supports application logic and storage needed for custom workflows and monitoring use cases. That is exactly what fits a requirement to build an app that monitors a defined set of high-risk users and triggers alerts on suspicious activity.
Why the other options are incorrect:
Falcon QueryBuilder is for constructing queries, not building an application. Falcon Spotlight is CrowdStrike's vulnerability management capability, not an app-development framework. Charlotte AI is an AI assistant capability, not the platform feature used to develop custom monitoring apps. The only option that matches "develop this app" is Falcon Foundry .