4.3 Identify Potential Security Issues — Such as Malware Presence, High-Severity Common Vulnerabilities and Exposures (CVEs), Detected Leaked Secrets and Docker File Misconfigurations — from the Image Assessment Report CCCS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A developer is reviewing the Dockerfile for a container image and sees the following instruction: `ADD https://example.com/app.tar.gz /app/`. The image assessment report flags this as a security issue. What is the primary concern?

   • AThe file will be extracted automatically, which is a security risk
   • BThe file is downloaded without integrity verification, allowing potential tampering
   • CThe URL is not accessible from within the container
   • DThe file will be owned by root, which is a security risk
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why does an image assessment report flag a Dockerfile instruction that adds a secret as an environment variable?

   • ABecause it makes the container run with elevated privileges.
   • BBecause it increases the image size significantly.
   • CBecause it prevents the container from starting.
   • DBecause it exposes the secret in the image layers and to anyone with access to the image.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which section of the image assessment report would list known Common Vulnerabilities and Exposures (CVEs) affecting packages in the image?

   • AThe 'Malware' section.
   • BThe 'Dockerfile' section.
   • CThe 'Vulnerabilities' or 'CVEs' section.
   • DThe 'Secrets' section.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is triaging findings from an image assessment report for a critical application. The report shows: a malware detection in a rarely used utility, a critical CVE in the application's main dependency, and a leaked database password. The team has limited resources and can address only one issue immediately. Which issue should they address first?

   • AThe malware detection in the rarely used utility
   • BAll three issues simultaneously
   • CThe leaked database password
   • DThe critical CVE in the main dependency
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security review of a container image's Dockerfile shows the following instruction: `USER root`. The image is for a microservice that only needs to read from a mounted volume. What is the primary security concern with this configuration?

   • AThe container runs with unnecessary privileges, increasing the impact of a compromise
   • BThe container will be unable to write to the mounted volume
   • CThe container cannot read from the mounted volume because root lacks permissions
   • DThe container will fail to start because root is not allowed in containers
   Reveal Solution Discussion Select an answer first