When remediation capacity is limited,CrowdStrike Falcon Cloud Securityemphasizesrisk-based prioritizationfocused onactual exposurerather than theoretical severity alone.

Filtering vulnerabilities bycontainer running statusallows teams to identify which vulnerable images areactively running and exposed, particularly those that arepublic-facing. Remediating vulnerabilities in running containers first reduces real-world risk immediately, while dormant or unused images can be addressed later.

CVSS scores and CVE age do not account for exploit accessibility or operational exposure. Taking the business offline is impractical and unnecessary when targeted remediation can significantly reduce risk.

Therefore, the correct and CrowdStrike-aligned approach is tofilter by container running status, makingOption Dthe correct answer.