Option A: Scheduled reports must be configured with specific parameters such as data sources (cloud assets, compliance findings, threat detections), reporting frequency (daily, weekly, monthly), and delivery methods (email, dashboard, or external integrations).
Option B: While admin-level users can configure reports, role-based access control (RBAC) in CrowdStrike allows specific roles, such as security analysts, to set up and receive reports without full platform access.
Option C: Scheduled reports do not perform automatic mitigation; they provide insights and recommendations, but security teams must take action based on the findings.
Option D: Scheduled reports are automated, meaning that once configured, they are generated periodically without requiring manual execution.

Option A: This is the correct command syntax for manually scanning container images using CrowdStrike's command-line tool. The falcon-image-scan command is specifically designed for this purpose and requires flags like --registry and --image to specify the image's location and name. This ensures proper configuration for the scan to target the desired image in the specified registry.
Option B: alconctl is a valid CrowdStrike tool, but it is used for endpoint configuration, not container image scanning. This command incorrectly combines the wrong tool with a scanning function.
Option C: This command structure is fictional and does not align with any CrowdStrike CLI tool or syntax. It might mislead users into assuming the availability of a nonexistent utility.
Option D: While this syntax might resemble a generic CLI tool, cscli is not the command-line tool used by CrowdStrike for image assessment. This option confuses CrowdStrike tools with other third-party solutions.

Option A: Installing a CrowdStrike sensor on the registry server is not necessary for integrating image scanning. The connection is established through the Falcon console configuration.
Option B: CrowdStrike does not auto-discover registries. You must manually configure the connection by providing the necessary details in the Falcon console.
Option C: Opening the registry to public access is a major security risk. CrowdStrike requires proper authentication and secure communication rather than public access to perform image assessments.
Option D: The integration requires you to register the registry in the CrowdStrike Falcon console by specifying the registry's URL, credentials, and authentication method. This ensures secure communication between the registry and CrowdStrike, enabling image scanning.

Option A: Deleting virtual machines is unnecessary for deprovisioning. The focus should be on severing integration points between Falcon and the cloud account.
Option B: Removing the account from the Falcon console ensures that Falcon no longer attempts to monitor it. Disabling API access prevents further interaction and completes the deprovisioning process.
Option C: Revoking permissions alone is insufficient because the account remains linked to Falcon. Proper deprovisioning requires both removing the account and disabling API access.
Option D: Uninstalling endpoint agents is irrelevant to deprovisioning a cloud account from Falcon. Agents operate independently from cloud account registration.

Option A: Content trust ensures that images come from verified sources, and the flag should be set to true rather than false. Using --disable-content-trust=false means that unverified, potentially malicious images could be pulled.
Option B: The CIS Docker Benchmark recommends running containers as non-root users and enforcing least privilege access to reduce attack surface. Running containers with root privileges can lead to security vulnerabilities and compliance violations.
Option C: Storing sensitive information in environment variables is a security risk because they can be accessed by any process running in the container. Instead, secrets should be stored in secure vaults or Kubernetes Secrets.
Option D: Privileged mode grants containers full access to the host system, significantly increasing security risks. This violates industry best practices and should only be used in highly controlled environments.