Container Security CV0-004 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a best practice for handling secrets in containerized applications?

   • AStoring secrets as environment variables in the container image
   • BInjecting secrets into containers at runtime from a secure secrets store
   • CHard-coding secrets in the application source code for simplicity
   • DSharing secrets between containers using a shared volume
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A platform team manages a shared Kubernetes cluster for multiple development teams. Each team has its own namespace. The security team requires that developers can only view and manage resources within their own namespace, and that they cannot access secrets belonging to other teams. What should be implemented?

   • ACreate a Kubernetes ClusterRole and ClusterRoleBinding for each team that grants permissions across all namespaces.
   • BUse the default namespace for all teams and rely on the developers to avoid accessing each other's resources.
   • CCreate a Kubernetes Role and RoleBinding for each team that grants permissions only within their respective namespace.
   • DGrant all developers cluster-admin access so they can manage their own resources without restrictions.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multi-tenant platform runs untrusted customer code in containers on a shared Kubernetes cluster. A customer's container needs to access a database that stores sensitive data. The security team is concerned about a container escape allowing access to other customers' data. Which combination of controls provides the strongest defense-in-depth?

   • AUse a sandboxed runtime like gVisor or Kata Containers, enforce a read-only root filesystem, and use a NetworkPolicy to restrict egress.
   • BDisable the container's network access entirely and require all communication to go through a proxy.
   • CRun containers in a separate pod per customer, use a restrictive NetworkPolicy, and store database credentials in Kubernetes Secrets.
   • DGrant each container a privileged security context so it can manage its own resources and avoid conflicts.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices unusual outbound network connections from a containerized application that should only communicate with an internal database. The container is running with default settings. Which runtime security measure would best detect and alert on this behavior without disrupting the application?

   • AEnable a container runtime security tool that monitors process and network activity and compares it against a baseline of expected behavior.
   • BRestart the container with a read-only filesystem to prevent any changes to its configuration.
   • CSet the container's CPU and memory limits to reduce its ability to perform malicious activities.
   • DDisable the container's network interface entirely to prevent any outbound connections.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security scan reveals that a container image running in production contains a known vulnerability in a shared library. The library is used by several other containers in the environment. The security team wants to remediate the issue with minimal disruption to the running services. What should be done first?

   • APatch the library directly inside the running containers using a shell command.
   • BImmediately stop all containers using the vulnerable library and wait for a patched image to be built.
   • CRebuild the affected image with a patched version of the library, test it, and then perform a rolling update of the containers.
   • DIncrease the container's resource limits to reduce the impact of the vulnerability.
   Reveal Solution Discussion Select an answer first