CCCS-203b CrowdStrike Certified Cloud Specialist

In CrowdStrike Falcon Cloud Security, Cloud Groups can be applied to container images using three specific image attributes: Image registry, Image repository, and Image tag. These attributes uniquely identify container images and allow precise scoping of policies and visibility.

Image registry identifies where the image is hosted (for example, Amazon ECR or Docker Hub).

Image repository defines the namespace or project within that registry.

Image tag specifies the version or variant of the image.

Together, these attributes provide a consistent and cloud-native method to group images across environments. Other attributes such as image version or type are not used as Cloud Group selectors in Falcon. Therefore, the correct answer is Image registry, Image repository, and Image tag.

CrowdStrike Falcon Cloud Security performs agentless cloud security posture management (CSPM) by integrating directly with cloud service providers such as AWS, Microsoft Azure, and Google Cloud Platform using native APIs. This approach allows Falcon to continuously assess cloud configurations, permissions, networking, storage, and identity controls without deploying sensors or agents.

By default, CrowdStrike configures cloud account scans to run every 4 hours . This scan frequency is designed to strike a balance between near-real-time visibility and efficient API usage across cloud providers. Cloud environments are highly dynamic, with frequent changes to configurations, IAM policies, and services. A four-hour scan interval ensures that new misconfigurations or risky changes—such as overly permissive roles, exposed storage, or insecure network rules—are identified quickly enough to reduce exposure time

Scanning more frequently could introduce unnecessary API throttling or operational overhead, while less frequent scans could delay detection of critical security gaps. The four-hour interval is therefore CrowdStrike’s recommended default for maintaining continuous visibility while preserving cloud provider performance and stability.

This default interval can be adjusted in certain scenarios, but unless explicitly changed, every 4 hours is the standard scan cadence applied to AWS, Azure, and GCP environments.