TBH, I’m not sure what the deal is with the grader in either case. I’ve just tried both Q3 and Q6 of this mock exam, and I passed both of these questions. Your answers look right, and I’m not sure why they did not pass the grader. I also got trivy to work with the (very questionable) note that engineering has added to Q3; I say “questionable” because they are teaching you to code to the lab environment, which has now diverged from the exam environment 
With Q6, check to make sure that falco is in fact running (systemctl status falco). Both of your files look correctly modified, but I could be missing something from the image. I did similar modifications, which passed the grader.