Container Security CV0-004 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of maintaining audit trails in a container environment?

   • ATo automatically block unauthorized access attempts
   • BTo provide a record of security events for compliance and investigation
   • CTo optimize container performance by analyzing logs
   • DTo encrypt sensitive data stored in containers
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A managed Kubernetes service is used to run a containerized application that accesses a cloud provider's object storage. The application needs to authenticate to the storage service. The security team wants to avoid storing long-lived credentials in the cluster and wants to rotate credentials automatically. What is the most appropriate approach?

   • ACreate a Kubernetes Secret with the storage account key and mount it as an environment variable in the container.
   • BUse a Kubernetes Secret and manually rotate it every 30 days.
   • CUse a cloud provider's workload identity feature to assign a temporary identity to the pod that can access the storage service.
   • DStore the storage account key in a Git repository and have the container pull it at startup.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard · select all that apply

   A healthcare organization must comply with HIPAA, which requires an audit trail of who accessed protected health information (PHI) and when. The organization runs a containerized application that processes PHI in a Kubernetes cluster. Which of the following measures should be implemented to meet the audit requirement? (Select all that apply.)

   • AConfigure the application to log all access to PHI with timestamps and user identifiers.
   • BGrant all developers cluster-admin access to simplify log access.
   • CDisable audit logging to reduce the amount of data stored.
   • DEnable Kubernetes audit logging to capture all API requests.
   • EStore all logs in a centralized, tamper-evident logging system.
   Check answers Discussion Select an answer first
5. 29application · medium

   A development team builds a container image from a base image pulled from a public registry. The security team mandates that only images with a known provenance and no known critical vulnerabilities can be deployed to production. Which combination of actions should be part of the CI/CD pipeline?

   • AScan the base image for vulnerabilities once and then reuse the same base image for all future builds without re-scanning.
   • BPull the base image, build the application image, and push it directly to the production registry without any additional checks.
   • CUse a public base image but only check the image's download count and user reviews to determine if it is safe.
   • DUse a private registry as the only source for base images, scan the final image for vulnerabilities, and sign the image with a trusted key before pushing it to production.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a compliance requirement that affects container environments?

   • AEnsuring that audit logs are retained for a specified period
   • BEncrypting all container images with the same key
   • CUsing the latest container runtime version
   • DAllowing all containers to communicate freely
   Reveal Solution Discussion Select an answer first