Option A: Image authors may provide useful information, but relying solely on their documentation is risky. They might not have updated their documentation with the latest vulnerability information, and the analysis would lack thoroughness.
Option B: While keeping the orchestration platform updated is important, this does not address vulnerabilities within the container image itself. The two are separate layers of the container ecosystem.
Option C: Static analysis scanning tools are purpose-built to analyze container images for vulnerabilities in installed packages, libraries, and dependencies. They use vulnerability databases (e.g., CVE databases) to identify known issues, enabling you to patch or replace insecure packages before deploying the image.
Option D: Comparing images can help identify deviations but does not specifically identify vulnerabilities in installed packages. A static analysis scan is more comprehensive and accurate for this purpose.

Option A: Transferring permissions without a clear business need or appropriate analysis can lead to excessive privilege assignments and violate the principle of least privilege, increasing the risk of insider threats or accidental misuse.
Option B: Temporarily disabling inactive accounts allows organizations to verify whether the accounts are genuinely no longer in use while preventing immediate security risks. Monitoring for unexpected activity during the temporary disablement phase helps identify potential misuse or ongoing necessity of the account, ensuring informed decisions about deactivation or deletion.
Option C: Deactivating accounts without addressing roles and permissions still poses a security risk. Inactive accounts with retained permissions can be re-enabled or misused inappropriately.
Option D: While deleting inactive accounts removes potential attack vectors, this approach is risky without prior analysis. Some accounts may be needed for legacy systems or auditing purposes, leading to operational disruption.

Option A: Assessed/unassessed items relate to whether vulnerability assessment has occurred.
This choice incorrectly describes their scope and misapplies the terminology to accounts or containers instead of container images.
Option B: Managed/unmanaged items do not refer to container images specifically. This conflates the concept of container images (assessed/unassessed) with managed/unmanaged accounts or containers. The status of being managed/unmanaged pertains to whether the item is actively monitored, not the vulnerability state.
Option C: Managed items are accounts or containers actively integrated with and monitored by Falcon Cloud Security. Unmanaged items are those outside the scope of Falcon monitoring, often requiring additional steps to bring them under management. This distinction is fundamental to understanding CrowdStrike's coverage capabilities.
Option D: This explanation accurately describes assessed/unassessed items, not managed/unmanaged items. The former pertains to whether a container image has been scanned for vulnerabilities.

Option A: This is incorrect because the Falcon sensor focuses on runtime protection and process monitoring. Vulnerability scanning is a separate feature, often provided by CrowdStrike's Cloud Security module or other integrated tools.
Option B: The Falcon sensor offers robust runtime protection, which includes monitoring processes and detecting potentially malicious activities inside both the host and containers. This functionality helps identify threats in real-time, making it a critical component of securing Kubernetes workloads.
Option C: This is incorrect as RBAC policies remain a fundamental part of Kubernetes security.
The Falcon sensor complements, but does not replace, Kubernetes native security configurations like RBAC.
Option D: While the Falcon sensor provides process and file activity monitoring, it does not perform deep packet inspection for network traffic. This would require a separate network security solution.

Option A: Kernel-level protections are managed by the CrowdStrike Falcon Container Sensor, not the Admission Controller. The Admission Controller focuses on admission-time security policies rather than runtime protections.
Option B: The Kubernetes Admission Controller intercepts pod creation requests submitted to the Kubernetes API server. It verifies these requests against security policies configured by the CrowdStrike platform, such as ensuring containers include the CrowdStrike Falcon sensor or restricting the use of insecure configurations (e.g., running containers as root). This functionality enforces security at the earliest stage of workload deployment.
Option C: Vulnerability scanning is typically performed by image scanning tools or registry integrations. The Admission Controller does not scan images but ensures security compliance during pod admission.
Option D: Network monitoring and blocking are functions of network security solutions, not the Kubernetes Admission Controller. The Admission Controller focuses solely on admission control.