6.4 Compare Cloud, Docker and Kubernetes Configurations to the Latest Industry Benchmarks to Determine Compliance CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is assessing a Kubernetes cluster against the CIS Kubernetes Benchmark. The cluster uses Role-Based Access Control (RBAC) and network policies. Which configuration would be considered non-compliant according to the benchmark?

   • AThe kubelet is configured to allow privileged containers.
   • BThe etcd data directory is encrypted at rest.
   • CThe cluster has network policies that restrict traffic between pods.
   • DThe API server is configured with the '--anonymous-auth=false' flag.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevOps team is building a Docker image for a web application. They want to ensure the image configuration complies with the Docker CIS Benchmark. Which practice should they implement during the image build process?

   • AExpose all necessary ports in the Dockerfile to simplify network configuration.
   • BUse the latest base image tag (e.g., 'latest') to ensure all updates are included.
   • CRun the container as a non-root user and set the filesystem to read-only where possible.
   • DStore secrets as environment variables in the Dockerfile for easy access.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   According to the CIS Kubernetes Benchmark, which configuration is recommended for the Kubernetes API server?

   • AAllow all API requests without authentication
   • BEnable anonymous authentication for monitoring
   • CUse HTTP instead of HTTPS for API communication
   • DDisable anonymous authentication
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the first step in a systematic methodology for comparing configurations to industry benchmarks?

   • ADeploy automated tools to enforce the benchmark
   • BGenerate a compliance report for management
   • CRemediate all non-compliant configurations immediately
   • DIdentify the applicable benchmark for the technology being assessed
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is using Google Cloud Platform (GCP) and wants to assess compliance with the CIS Google Cloud Computing Platform Benchmark. Which action should be taken to ensure the assessment is valid?

   • AUse the CIS benchmark version that was current when the GCP project was created.
   • BRely on GCP's built-in security recommendations without external benchmarks.
   • CUse the AWS CIS benchmark instead because it is more comprehensive.
   • DDownload the latest CIS benchmark for GCP and compare the project's configurations against it.
   Reveal Solution Discussion Select an answer first