4.2 Given a Use Case, Recommend an Appropriate Image Assessment Method for Your Environment CCCS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A media company has a large library of VM images that were built over several years. The security team wants to identify which images contain outdated operating systems and known vulnerable packages, prioritizing the most critical ones first. The team has limited time and budget. Which approach is most efficient for this initial assessment?

   • ADetonate a random sample of images to check for malware
   • BManually inspect each image's creation date and base OS version
   • CDeploy all images to a test environment and monitor them for suspicious activity
   • DRun a static scan across the entire image library and sort results by severity
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to assess a container image that is suspected of containing a known ransomware strain. The image is not going to be deployed, and the team wants to confirm the presence of the ransomware quickly. Which method is most appropriate for this confirmation?

   • ADynamic analysis to observe the ransomware's encryption behavior
   • BComparing the image's base OS to a list of commonly targeted systems
   • CManual review of the image's file names and sizes
   • DStatic scanning with a malware signature database
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company wants to assess container images for malicious behavior that only occurs when the container is started with specific environment variables. The images are built in-house and are not suspected of containing known malware. Which assessment method is most appropriate?

   • ADynamic analysis that starts the container with the specified environment variables and monitors its behavior
   • BStatic scanning of the image layers for known malware signatures
   • CReviewing the image's Dockerfile for suspicious environment variable usage
   • DComparing the image to a known-good baseline from the same build
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A government agency requires that all images be assessed for malware before deployment, but the images contain classified data and cannot be processed by any external service. The agency has a high-performance on-premises cluster. The security team must also provide a report for each image showing that it was assessed. Which method should they implement?

   • AOn-premises malware detonation with automated report generation for each image
   • BStatic scanning only, with a manual attestation from the security team
   • CCloud-based static scanning with a signed compliance report
   • DHash-based comparison against a classified malware database
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company builds a new container image pipeline. The security team requires that every image be checked for known vulnerable packages and exposed secrets before it is pushed to the production registry. The pipeline must complete within 10 minutes per build, and developers need a list of findings with severity levels to triage. Which image assessment method should the team implement?

   • AManual review of the Dockerfile and base image tags by the security team
   • BDynamic analysis by running the container in a sandbox and observing its behavior
   • CMalware detonation in an isolated virtual machine before each deployment
   • DStatic scanning of the image filesystem and metadata during the CI/CD build
   Reveal Solution Discussion Select an answer first