CrowdStrike CCCS-203b Exam - Topic 7 Question 19 Discussion

Question

Your team wants to review container vulnerabilities on a weekly basis. Not all members of the team reviewing the information will have access to the Falcon console.

How can you automatically distribute the vulnerable container information from Cloud Security?

Enola · Accepted Answer

B) Create a scheduled report to list vulnerable container data from the last 7 days

Enola · Answer

A) Create a scheduled report to list vulnerable container data from the last 24 hours

Enola · Answer

C) Create a query using Advanced Event Search and run the query once a week

Enola · Answer

D) Create a dashboard displaying the vulnerable container information and share the link
CrowdStrike Falcon Cloud Security supports scheduled reporting as the preferred mechanism for automatically distributing security findings to stakeholders who may not have direct access to the Falcon console. When container vulnerabilities need to be reviewed on a weekly basis, the correct and most operationally efficient approach is to create a scheduled report covering the last 7 days.
Scheduled reports can be configured to run automatically and delivered via email to designated recipients, including users without Falcon console access. This makes them ideal for cross-functional teams, auditors, or management who require regular visibility into container risk without interactive access.
Using Advanced Event Search requires console access and manual execution, which does not meet the requirement for automatic distribution. Dashboards also require console access and cannot be securely shared externally. A 24-hour report would not align with the stated weekly review cadence and could result in incomplete visibility.
CrowdStrike documentation and best practices recommend scheduled reports for recurring compliance, vulnerability, and risk reporting use cases. Therefore, the correct solution is to create a scheduled report to list vulnerable container data from the last 7 days.