4.2 Given a Use Case, Recommend an Appropriate Image Assessment Method for Your Environment CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cloud provider offers a managed service that runs customer-provided container images. The provider wants to detect images that attempt to exploit the host kernel or escape the container runtime. Which image assessment method is best suited for this specific threat?

   • AChecking the image size and layer count for anomalies
   • BDynamic analysis in a sandbox that monitors system calls and kernel interactions
   • CStatic scanning of the image for known CVE signatures
   • DReviewing the image's entrypoint and command configuration
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which image assessment method is primarily used to identify known vulnerabilities and misconfigurations in a container image without executing it?

   • AMalware detonation
   • BDynamic analysis
   • CStatic scanning
   • DRuntime monitoring
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational company must comply with data residency laws that prohibit certain images from being processed outside a specific geographic region. The company has a global CI/CD pipeline and wants to scan images for malware. The security team needs a method that can be deployed within the region and does not rely on external services. Which approach is most appropriate?

   • ASkip malware scanning for images subject to the residency law
   • BScan images in the nearest available region and document the data flow
   • CDeploy a regional static scanning and malware detonation service within the required region
   • DUse a global scanning service and rely on the vendor's data residency guarantees
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution must comply with a regulation that requires all container images to be free of malware before production deployment. The compliance team wants a documented, auditable process. The engineering team notes that some images contain proprietary algorithms that cannot be shared with external vendors. Which image assessment strategy satisfies both the regulatory and confidentiality constraints?

   • ADetonate images in a public cloud sandbox and redact the proprietary parts
   • BSend all images to a third-party scanning vendor for a comprehensive report
   • CUse only static scanning and document that malware detection is not required
   • DRun static scanning internally and malware detonation in an on-premises sandbox, with logs retained for audit
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A team needs to assess images for known vulnerabilities quickly and with minimal performance impact. Which method should they recommend?

   • AStatic scanning
   • BDynamic analysis
   • CMalware detonation
   • DFull sandbox execution
   Reveal Solution Discussion Select an answer first