To ensure CrowdStrike can perform uninterrupted image assessments, which of the following steps must you take when adding CrowdStrike IP addresses to your container registry allowlist?

To perform image assessments on private container registries, the CrowdStrike Falcon platform must be able to connect to the registry from its cloud infrastructure. Firewalls or network access control lists protecting the registry must be configured to permit these connections. The CrowdStrike Falcon Console provides the specific, authoritative list of source IP addresses used by the image scanning service for the customer's designated cloud region. Adding these exact IP addresses to the registry's allowlist is the required step to ensure the scanner can access images without interruption. This ensures that only legitimate CrowdStrike traffic is permitted.

A. This is too general. While the IPs are from regional data centers, the specific, up-to-date list required for the image assessment feature is provided directly in the Falcon Console.
B. Image scanning is an external service performed by the CrowdStrike cloud; allowing internal IPs would not grant access to the external scanner.
C. A denylist (or blocklist) would explicitly block CrowdStrike's access, which is the opposite of the required action to allow scanning.

1. CrowdStrike, Inc. (2023). Falcon Cloud Security: Image Assessment Documentation. Falcon Console Help System. Section: "Add a registry". "For private registries, you must allowlist the IPs provided in the Falcon console for your region to allow the Falcon scanner to pull images. You can find the list of IPs to allowlist in the Falcon console at Cloud Security > Image Assessment > Registry Credentials."

2. CrowdStrike, Inc. (2023). Falcon Cloud Security Deployment Guide. Document ID: CS-HG-2301. Section 4.2: "Configuring Registry Integration". "To enable scanning of images hosted in a private registry, network controls must be configured to allow inbound traffic from CrowdStrike's scanning infrastructure. The required IP addresses are listed within the Falcon UI and must be added to the appropriate allowlists."