Option A: Immediately deleting assets without investigation can cause disruptions if they are in use by critical services. Verification is essential before taking action.
Option B: Unmanaged public-facing assets pose a significant security risk. The best practice is to identify ownership, assess their legitimacy, and either enforce security policies or decommission them if unnecessary. Shadow IT, forgotten deployments, or misconfigured assets can all lead to breaches.
Option C: Network segmentation can limit exposure, but it does not address the root cause--why these assets exist and whether they are necessary or unauthorized.
Option D: Restricting outbound traffic may reduce risk, but it does not address the issue of unmanaged public exposure. Attackers could still exploit misconfigurations or known vulnerabilities on these assets.

Option A: This is the correct choice because Falcon CWP is specifically designed for Kubernetes environments, providing visibility into containers, real-time threat detection, and runtime protection. It integrates seamlessly with Kubernetes without impacting ephemeral workloads.
Option B: Falcon LogScale is focused on centralized logging and event analysis. While it helps with incident investigation, it does not provide active runtime protection for Kubernetes workloads.
Option C: This sensor is designed for endpoint security on user devices like laptops and desktops. It does not support Kubernetes-specific security needs such as container introspection and runtime threat detection.
Option D: While the Windows server sensor is useful for traditional on-prem and cloud-hosted VMs, it is not optimized for containerized workloads in Kubernetes. It lacks deep container visibility and runtime protection features specific to Kubernetes.

Option A: High-severity Common Vulnerabilities and Exposures (CVEs) indicate critical security risks, such as the ability to execute arbitrary code, privilege escalation, or data exfiltration.
System libraries are fundamental to the container's operation, and their vulnerabilities can be exploited to compromise the entire container or host. Addressing these vulnerabilities is crucial to prevent exploitation.
Option B: Deprecated or unused packages can increase the attack surface but are not as immediately critical as high-severity CVEs. These can be removed to streamline the image but do not represent an active threat unless they contain exploitable vulnerabilities.
Option C: Comments in a Dockerfile improve maintainability and readability but have no bearing on the security of the image itself. This is a best practice for developers, not a critical security issue.
Option D: While hardcoded credentials are a significant security concern, they typically represent an issue of configuration or secret management rather than a systemic vulnerability in the image.
They may also be environment-specific, making them less critical than systemic vulnerabilities like CVEs in system libraries.

Option A: This is a manual and error-prone process that does not scale well for complex images.
It also fails to cross-reference vulnerabilities in real-time.
Option B: An SBOM provides a detailed inventory of all installed packages and dependencies in a container image. Container security scanning tools can automatically generate this information and cross-reference it with vulnerability databases, ensuring efficient and accurate reviews.
Option C: While technically possible, this approach is inefficient and unnecessary when purpose- built tools exist. Writing and maintaining such a script is time-intensive and error-prone.
Option D: This is an impractical and incomplete approach. Vulnerabilities cannot be reliably identified by manually inspecting files without the context of vulnerability databases or automated tools.

Option A: Deploying the Falcon agent to workloads is not a prerequisite for registering the cloud account. Agent deployment is a separate step focused on workload protection, not account registration.
Option B: There is no requirement to upload metadata via a CSV file during the registration process. Falcon Cloud Security collects metadata automatically once permissions are granted.
Option C: While vulnerability scanning is an important feature of Falcon Cloud Security, it is not a step in the account registration process. Scanning requires additional configurations after registration.
Option D: Granting the necessary permissions through an API role or service account is a critical first step in registering a cloud account with Falcon. Without these permissions, Falcon Cloud Security cannot monitor or secure resources within the account.