4.2 Given a Use Case, Recommend an Appropriate Image Assessment Method for Your Environment CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security team needs to assess container images for compliance with a policy that requires all images to be free of known critical vulnerabilities before deployment. Which environmental factor is most directly addressed by this requirement?

   • ACompliance requirements
   • BOperational constraints
   • CThreat model
   • DNetwork architecture
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A startup with a small security team uses a serverless function to process images before they are stored. The team wants to check images for known malware and vulnerabilities but has no dedicated sandbox infrastructure and wants to minimize operational overhead. Which approach is most appropriate?

   • AUse a cloud-based static scanning API integrated into the serverless function
   • BManually download and inspect each image with a local antivirus tool
   • CDeploy a dedicated VM to run dynamic analysis on every image
   • DBuild and maintain an on-premises malware detonation sandbox
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software vendor receives a suspicious container image from an untrusted third-party partner. The image is believed to contain obfuscated malware that only activates under specific runtime conditions. The vendor wants to confirm the malicious behavior before deciding whether to block the partner. Which image assessment method is most appropriate for this investigation?

   • AStatic scanning of the image layers for known vulnerability signatures
   • BMalware detonation in an isolated sandbox with network and system monitoring
   • CComparing the image digest against a public malware hash database
   • DReviewing the image's base OS and installed package list for outdated versions
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A defense contractor builds VM images that are deployed to an air-gapped environment. The security team must ensure the images are free of malware, but the images cannot be sent to any external scanning service due to data classification rules. The team has a dedicated on-premises sandbox with network monitoring. Which image assessment method should they use?

   • APerform static scanning only, since the image cannot leave the facility
   • BRun malware detonation in the on-premises sandbox and analyze the network traffic
   • CUpload the image to a cloud-based scanning service for a thorough analysis
   • DCompare the image hash against a public malware database hosted on the internet
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's security team is evaluating image assessment methods and wants to choose one that provides the deepest insight into what a container actually does when it runs, including its network connections and file system modifications. The team is willing to accept a longer assessment time. Which method should they choose?

   • ADynamic analysis in a sandbox with network and file system monitoring
   • BReviewing the image's documentation and build scripts
   • CComparing the image digest against a known-good baseline
   • DStatic scanning of the image layers and configuration
   Reveal Solution Discussion Select an answer first