Container Security CV0-004 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a runtime security measure for containers?

   • AEncrypting the container image in the registry
   • BScanning the container image before it is deployed
   • CRestricting access to the container registry with IAM policies
   • DUsing an intrusion detection system (IDS) to monitor container activity
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of an access control mechanism for containers?

   • AMonitoring container logs for suspicious activity
   • BEncrypting the container's filesystem
   • CScanning container images for vulnerabilities
   • DUsing role-based access control (RBAC) to define permissions for users and services
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a recommended practice for patching container images?

   • ARebuilding images from updated base images and redeploying containers
   • BWaiting for a security incident before applying patches
   • CUpdating the container runtime only, without updating images
   • DPatching containers directly while they are running
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A containerized application needs to authenticate to an external API using a client secret. The development team currently stores the secret in a plain text file inside the container image. A security audit flags this as a risk. What is the most secure way to provide the secret to the container at runtime?

   • AHardcode the secret in the application's source code and compile it into the binary.
   • BUse a secrets management solution like HashiCorp Vault and inject the secret into the container at runtime.
   • CStore the secret in an environment variable in the container's Dockerfile.
   • DPass the secret as a command-line argument when starting the container.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company runs a containerized application in a Kubernetes cluster. The application must communicate with an external service over the internet, but the security team wants to ensure that the traffic is encrypted and that the container cannot initiate connections to any other external IP addresses. What should be configured?

   • AUse a Kubernetes Ingress resource to route traffic to the external service and enable HTTPS on the Ingress.
   • BConfigure the container to use the host network and rely on the host's firewall to restrict outbound connections.
   • CUse a Kubernetes NetworkPolicy that allows egress only to the external service's IP address and port, and configure the application to use TLS.
   • DSet the container's DNS to a private resolver and block all external DNS queries.
   Reveal Solution Discussion Select an answer first