6.4 Compare Cloud, Docker and Kubernetes Configurations to the Latest Industry Benchmarks to Determine Compliance CCCS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team must assess compliance of both a cloud environment and a Kubernetes cluster. They have limited resources and need to prioritize. The cloud environment has no critical findings, but the Kubernetes cluster has several high-severity issues. What should the team do?

   • ARe-assess the cloud environment first to confirm there are no issues.
   • BIgnore the Kubernetes issues because the cloud environment is more important.
   • CSplit resources evenly between both environments to address all findings simultaneously.
   • DAllocate resources to remediate the Kubernetes issues first, then re-assess the cloud environment.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Kubernetes cluster has the '--etcd-cafile' and '--etcd-certfile' flags set for the API server. According to the CIS Kubernetes Benchmark, what is the compliance status for etcd communication?

   • ANon-compliant, because the flags should be set to '--etcd-keyfile'.
   • BCompliant, because TLS is enabled for etcd communication.
   • CNon-compliant, because etcd should not use TLS.
   • DCompliant, because the flags are set but not used.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer is creating a Dockerfile for a new service. To comply with the Docker CIS Benchmark, which instruction should be included in the Dockerfile?

   • AENV SECRET_KEY=supersecret to pass configuration securely.
   • BUSER root to ensure the application has necessary permissions.
   • CEXPOSE 22 to allow SSH access for debugging.
   • DCOPY --chown=appuser:appuser to set proper ownership for the application files.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Docker container is running with the '--privileged' flag. According to the Docker CIS Benchmark, what is the compliance status?

   • ANon-compliant, because the flag should be '--cap-add=ALL'.
   • BCompliant, because privileged mode is needed for some applications.
   • CNon-compliant, because privileged mode grants excessive capabilities.
   • DCompliant, because the container is isolated.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   After comparing a Kubernetes cluster configuration to the CIS Kubernetes Benchmark, an analyst finds that the cluster is non-compliant in several areas. What is the most appropriate next step in the benchmark comparison methodology?

   • AChange the benchmark to match the current configuration
   • BImmediately delete the cluster and rebuild it
   • CIgnore the findings because the cluster is already in production
   • DDocument the gaps and prioritize remediation based on risk
   Reveal Solution Discussion Select an answer first