Container Security CV0-004 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a potential breach in a containerized environment. The analyst needs to determine if an attacker executed commands inside a container and if any data was exfiltrated. The environment uses Kubernetes with audit logging enabled. Which data source would provide the most direct evidence of command execution inside the container?

   • AKubernetes audit logs, which record API requests to the kubelet.
   • BContainer runtime logs, such as those from Docker or containerd, which capture the container's stdout and stderr.
   • CNetwork flow logs from the container's network namespace, which show all connections made by the container.
   • DHost system logs, such as /var/log/syslog, which record all system-level events.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of implementing access controls in a container environment?

   • ATo encrypt all data stored within the container
   • BTo automatically scale containers based on demand
   • CTo ensure that only authorized users and processes can interact with containers
   • DTo monitor container performance and resource usage
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of container isolation in a containerized environment?

   • ATo ensure that containers can communicate with each other only through a shared virtual network
   • BTo prevent containers from accessing each other's processes, files, and network resources without authorization
   • CTo guarantee that containers run on separate physical hardware to avoid resource contention
   • DTo allow containers to share the same filesystem and processes for better performance
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that a container is making unexpected outbound connections to an IP address that is not on the approved list. The container is running a web application that should only communicate with an internal API. What should be done to investigate and prevent this behavior?

   • ARestart the container to clear the unexpected connections.
   • BDisable the container's network interface to stop all outbound traffic.
   • CIncrease the container's memory limit to prevent it from being compromised.
   • DUse a runtime security tool to inspect the container's processes and network activity, then create a network policy to block the unexpected IP.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security scan identifies a critical vulnerability in a container image that is currently running in production. The vulnerability is in a base layer that is shared by multiple images. The security team needs to remediate the issue quickly but must also ensure that the fix is applied consistently across all affected containers. What is the most effective approach?

   • AUse a runtime security tool to block the vulnerable library from being loaded.
   • BPatch the running containers by executing a command inside each container to update the vulnerable library.
   • CRebuild the base image with the patched library, then rebuild all affected application images and redeploy them.
   • DIncrease the container's resource limits to reduce the impact of the vulnerability.
   Reveal Solution Discussion Select an answer first