4.3 Identify Potential Security Issues — Such as Malware Presence, High-Severity Common Vulnerabilities and Exposures (CVEs), Detected Leaked Secrets and Docker File Misconfigurations — from the Image Assessment Report CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical indicator of malware presence in an image assessment report?

   • AA package with an outdated version number.
   • BA file matching a known malware signature.
   • CA Dockerfile instruction that runs as root.
   • DAn environment variable containing a password.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An image assessment report flags a malware detection in a base image layer. The base image is from a public registry and is used by many other images in the organization. The security team must decide how to respond. What is the best course of action?

   • AQuarantine the base image and only allow images that do not use it to be deployed
   • BIgnore the detection because the base image is from a public registry and is widely used
   • CRemove the malware from the base image layer and continue using it
   • DReplace the base image with a trusted alternative and rebuild all dependent images
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps engineer is looking at an image assessment report and wants to see the specific files that contain leaked secrets. Where should the engineer look?

   • AThe image layers section
   • BThe details of the leaked secret finding
   • CThe Dockerfile section
   • DThe CVE section
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An image assessment report for a machine learning model training image flags a GitHub personal access token in a Jupyter notebook file. The token has read-only access to a private repository. The image is used by data scientists for experimentation. What is the most appropriate response?

   • ARevoke the token, remove it from the image, and educate data scientists on using secret management tools
   • BChange the token's permissions to read-only and keep it in the image for convenience
   • CRestrict access to the image registry to prevent external exposure
   • DIgnore the finding because the token has read-only access and the repository is private
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An image assessment report for a container image used in a CI/CD pipeline flags a private SSH key in the `/root/.ssh` directory. The key is used to access a Git repository. What is the most immediate action?

   • ARevoke the SSH key and remove it from the image
   • BIgnore the finding because the key is only used in the CI/CD pipeline
   • CMove the key to a different directory in the image
   • DChange the permissions of the key to 600 to secure it
   Reveal Solution Discussion Select an answer first