To identify remediable vulnerabilities in running containers , CrowdStrike Falcon Cloud Security recommends filtering image vulnerabilities by container running status and remediation . This approach correlates container runtime state with image assessment results, allowing security teams to focus on vulnerabilities that are both present in images and actively impacting running workloads .

Image vulnerability findings include remediation metadata such as fixed versions, patch availability, and upgrade paths. By filtering on container running status , you ensure that attention is limited to vulnerabilities that pose immediate risk rather than those in dormant or unused images. Adding the remediation filter further refines results to show only vulnerabilities that can realistically be addressed, helping teams prioritize efficiently.

Other options are incorrect because container assets and detections focus on runtime behavior, not vulnerability remediation context. Image detections relate to malware or suspicious artifacts, not CVEs.

This filtering method aligns with CrowdStrike best practices for vulnerability prioritization by combining runtime relevance and remediation feasibility , making option C the correct answer.

When investigating widespread Indicators of Misconfiguration (IOMs) such as Azure MFA not being enforced, CrowdStrike Falcon Cloud Security provides deeper investigative context through Event Search and Asset Graph. These two capabilities work together to move beyond a high-level finding count and into actionable insight.

Event Search allows analysts to query cloud control plane activity and identity-related events to understand how authentication policies are configured, modified, or bypassed over time. This helps determine whether MFA gaps are due to legacy configurations, recent changes, or specific identities or services.

Asset Graph provides a visual and relational view of cloud identities, subscriptions, roles, and permissions. It enables analysts to see which users, service principals, or resources are affected by missing MFA enforcement and how they are connected across the environment.

The other options do not provide the same depth of investigation. Identity & Cloud Group is primarily used for scoping visibility, while CloudTrail logging is AWS-specific and not applicable to Azure MFA findings. Therefore, the correct answer is Event search & Asset graph.

When using the Falcon Kubernetes Admission Controller , CrowdStrike allows administrators to precisely scope which Kubernetes assets are evaluated against Indicators of Misconfiguration (IOMs) and Image Assessment policies by using both namespaces and pod or service labels .

Namespaces provide a logical boundary within Kubernetes clusters, often representing environments such as dev, staging, or production. Labels add further granularity by identifying workloads based on application, team ownership, or deployment tier. By combining namespaces and labels, security teams can enforce policies with fine-grained control while minimizing unintended enforcement.

Using only namespaces or only labels limits flexibility and may lead to over- or under-enforcement. CrowdStrike documentation supports the combined approach as a best practice for scalable and precise policy enforcement in Kubernetes environments.

Therefore, the correct answer is Namespaces and Pod or Service labels .

In CrowdStrike Falcon Cloud Security, Cloud Groups can be applied to container images using three specific image attributes: Image registry, Image repository, and Image tag. These attributes uniquely identify container images and allow precise scoping of policies and visibility.

Image registry identifies where the image is hosted (for example, Amazon ECR or Docker Hub).

Image repository defines the namespace or project within that registry.

Image tag specifies the version or variant of the image.

Together, these attributes provide a consistent and cloud-native method to group images across environments. Other attributes such as image version or type are not used as Cloud Group selectors in Falcon. Therefore, the correct answer is Image registry, Image repository, and Image tag.

The CrowdStrike Kubernetes Admission Controller is a pre-runtime security control designed to enforce security policies before workloads are allowed to run in a Kubernetes environment. Its primary purpose is to monitor and enforce security policies in any containerized environment by intercepting Kubernetes API requests at admission time.

When a deployment, pod, or container is submitted to the Kubernetes API server, the Admission Controller evaluates the request against Falcon Cloud Security policies. These policies can include rules related to image risk posture, vulnerabilities, malware presence, secrets, or compliance violations. If an image violates defined policies, the Admission Controller can block the deployment, preventing insecure or non-compliant workloads from entering the cluster.

This capability is critical for implementing a shift-left security model , ensuring that threats are stopped before runtime , rather than detected after execution. While Falcon also provides runtime protection and visibility across managed Kubernetes platforms such as EKS and AKS, those capabilities are not the primary function of the Admission Controller itself.

The Admission Controller does not forward Kubernetes logs to SIEM platforms; instead, it acts as an enforcement gate. Therefore, the correct answer is Monitors and enforces security policies in any containerized environment .

When registering an AWS account with CrowdStrike Falcon Cloud Security, enabling real-time visibility and detection is recommended to improve overall security posture. This ensures continuous monitoring of cloud activity, identities, and resources rather than relying solely on periodic posture assessments.

Real-time detection allows Falcon to identify risky behavior, misconfigurations, and attack techniques as they occur, reducing dwell time and improving response effectiveness. The other options are not registration-specific security enhancements within Falcon.

Therefore, the correct answer is Real-time visibility and detection.

In CrowdStrike Falcon Cloud Security , IOAs are categorized using MITRE ATT & CK-aligned tactics to help analysts quickly identify attacker objectives. When investigating how a threat actor may have maintained access to cloud resources after an initial breach, the appropriate tactic to focus on is Persistence .

Persistence IOAs represent techniques such as creating backdoor IAM roles, modifying access policies, adding API keys, enabling long-lived credentials, or altering cloud configurations to survive reboots or credential rotation. Filtering the IOA dashboard by Persistence isolates these behaviors, enabling faster root-cause analysis and remediation.

Other filters serve different investigative purposes. Execution focuses on initial code execution, Privilege Escalation highlights elevation of permissions, and Ransomware identifies encryption-related activity. None of these specifically address long-term access maintenance.

Therefore, filtering by Persistence is the correct and most effective way to identify IOAs related to maintaining access within cloud environments.