4.3 Identify Potential Security Issues — Such as Malware Presence, High-Severity Common Vulnerabilities and Exposures (CVEs), Detected Leaked Secrets and Docker File Misconfigurations — from the Image Assessment Report CCCS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A DevOps engineer runs an image assessment on a container image before promoting it to a production registry. The report shows a malware detection in a layer that installs a third-party library. The engineer needs to decide the next step. What should the engineer do first?

   • ABlock the image from being promoted and investigate the source of the malware
   • BIgnore the detection because it is a false positive common with third-party libraries
   • CRemove the third-party library and rebuild the image without further analysis
   • DPromote the image and monitor runtime behavior for anomalies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An image assessment report for a web application container lists several CVEs. The application is internet-facing and handles sensitive customer data. Which CVE should the team address first?

   • AA low-severity CVE in a logging library that is not used in the application's code path
   • BA critical CVE in the web server software that is remotely exploitable
   • CA high-severity CVE in a command-line tool used only during development
   • DA medium-severity CVE in a database client library that requires local access
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An image assessment report flags a hardcoded API key in the image. What type of finding is this?

   • AA Dockerfile misconfiguration.
   • BA malware detection.
   • CA high-severity CVE.
   • DA leaked secret.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing an image assessment report and notices that the report includes a section called 'Findings' that lists malware detections, CVEs, and leaked secrets. The analyst wants to understand the severity of each finding. Where should the analyst look?

   • AThe severity column in the Findings section
   • BThe base image information section
   • CThe Dockerfile instructions section
   • DThe image layers section
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Dockerfile for a web application includes the instruction `RUN apt-get install -y curl`. The image assessment report flags this as a potential security issue. What is the most likely reason?

   • AThe instruction uses `apt-get` instead of `apt`, which is deprecated
   • BThe instruction should use `COPY` instead of `RUN` to install packages
   • CThe instruction does not pin a specific version of curl, leading to non-reproducible builds
   • DThe instruction installs curl, which is a security risk because it can be used to download malicious files
   Reveal Solution Discussion Select an answer first